diff --git a/grafana-secrets.yaml b/grafana-secrets.yaml
deleted file mode 100644
index 962d9c9..0000000
--- a/grafana-secrets.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-apiVersion: v1
-data:
-    GRAFANA_ADMIN_PASSWD: ENC[AES256_GCM,data:jxg51c5U2w6zgBXa,iv:nn2axEYen+kS0krlv2RXb2aHo29auu74QC5aHPmz6Nk=,tag:YUDr81JINm+oGYE5ESyDAQ==,type:str]
-    GRAFANA_ADMIN_USER: ENC[AES256_GCM,data:p7Ul3yAh9pc=,iv:WquGgBBeN/q0X0grDxkutE9KeaB7dSNvGuV1AcXPByQ=,tag:bm3iPB2f8f3sPVhE8ig4XQ==,type:str]
-kind: Secret
-metadata:
-    creationTimestamp: null
-    name: grafana-secrets
-    namespace: customer1
-sops:
-    age:
-        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNM2ZZWFhtRFdNNUhBbTB0
-            MHFsRHFPTTBac3B1OTNYUEtUaTV1WlVYYlVjCktWc1BkZHNhYmRHRURDMVhIUXNZ
-            TWpKa1A0OGM0NnE1YUxNekJCTTRCclUKLS0tIEp1VUFmcUZyWURsRkJxOFFLUU9W
-            eUJIQjQ3aVVGQlBzNm0vdUprRlNrYmcKpPl8FMLi2Z/hDZcwrJvxp+KgE/k2bynp
-            aNbdattl09RorT1gm8WB2nzA6UJwFiZduRnwOus9W6GFV402Igf3Og==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-22T19:23:41Z"
-    mac: ENC[AES256_GCM,data:HB/FVs4vUpSh32qJqH70CYE7KfG1hU52e0qEF73iJChGsfoawahf1WYS3EQcKaQm6w6Q2AgE88TDwHhOLzns57jqM+1gkBoQfAb/P2qYuv2G9YDMsEQT8C8cSQsCRatCub4064i1exjv9/VM6vr5bcF7oz7bWKZBV7CeTdkwikQ=,iv:nE4w/WBk/eP//rscPUc/CdW6BKMpqd+clNtnwrSQrBU=,tag:OvApAtKsdgaZpzEv0Wwn/Q==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
diff --git a/grafanaSecrets1.yaml b/grafanaSecrets1.yaml
deleted file mode 100644
index 39ab087..0000000
--- a/grafanaSecrets1.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-apiVersion: v1
-data:
-    grafana_admin_password: ENC[AES256_GCM,data:orvxn/NU9HDUKFwP,iv:8dAUYfKSKX9wL6/CBiU60wLSkZebDOjk/y7IcrVIFXw=,tag:Lb4Eku8S6HNbEa8xInF8iw==,type:str]
-    grafana_admin_user: ENC[AES256_GCM,data:/DjABi9gI6M=,iv:fXl0qg1+a3n8GXWT+zk2ooUvfyMpp/yT8UzFsEtTmtQ=,tag:FAF6kwq0aW5TVasXOwQobA==,type:str]
-kind: Secret
-metadata:
-    creationTimestamp: null
-    name: grafana_secrets
-    namespace: customer1
-sops:
-    age:
-        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuQkYwQjZVT3BqM0RLRCt4
-            eGY0aHRXYkJDQ1AzK1F5T0RuWFNVQVF5SWg4CkI0ckMrR01tcVVoU2c0SFZXTFJZ
-            ZitBMzUyQVNKMmtXNW1meFlUTy9VMFkKLS0tIEdaanlrVDBXWHd0dDZVdUlaZng0
-            RGhCNEQwaHd5QlFoRlBzR2swRVVQUG8K9ESwtVP7k8m4mwAdu5syks51uSzyv3xN
-            1ivdPU/Nzs3in1UNbdbg16PEGARrI2mh0DTHRCJcqFGyu3p92tqzww==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-22T19:23:34Z"
-    mac: ENC[AES256_GCM,data:NmMC0PT3QehIOeyi8yJ5h+KmZrygURNUOGYyu0xn3wCZQLJ5ry3SA8zwkjIkwZiaHs//yHoC7Xf245yxvdxDdIvSVpGjarhknaTbXrJWh5t0IHjG6nnvKIWT+E955ix5tBHA8BF21Ha1SmbGIEbtRdQExPiaze9vUHYsS2fNhYo=,iv:sG2+8TSYcAqH9PzeD5RA6xRVdVwSjK99kZFKPIJ+R+U=,tag:DugXE1/ax2r55nXCD7vRHg==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
diff --git a/infrastructure/controllers/base/certmanager/clusterissuer.yaml b/infrastructure/controllers/base/certmanager/clusterissuer.yaml
new file mode 100644
index 0000000..22138df
--- /dev/null
+++ b/infrastructure/controllers/base/certmanager/clusterissuer.yaml
@@ -0,0 +1,30 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: lancewalters94@gmail.com # Change if needed
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: mischa@mischavandenburg.com # Change if needed
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+
diff --git a/infrastructure/controllers/base/certmanager/kustomization.yaml b/infrastructure/controllers/base/certmanager/kustomization.yaml
new file mode 100644
index 0000000..d910ae9
--- /dev/null
+++ b/infrastructure/controllers/base/certmanager/kustomization.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ../../../../infrastructure/controllers/base/certmanager/  # Relative to git repo root
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system  # Your bootstrap GitRepo
+  healthChecks:
+    - name: cert-manager-webhook
+      kind: Deployment
+      namespace: cert-manager
+
diff --git a/infrastructure/controllers/base/certmanager/release.yaml b/infrastructure/controllers/base/certmanager/release.yaml
new file mode 100644
index 0000000..6e97b8f
--- /dev/null
+++ b/infrastructure/controllers/base/certmanager/release.yaml
@@ -0,0 +1,25 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: cert-manager
+      version: v1.15.3  # Pin stable version
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+        namespace: flux-system
+  targetNamespace: cert-manager
+  install:
+    createNamespace: true
+  values:
+    installCRDs: true
+    # GCP extras (optional):
+    # global.leaderElection.namespace: cert-manager
+    # webhook:
+    #   failurePolicy: Fail  # Strict mode
+
diff --git a/infrastructure/controllers/base/certmanager/repo.yaml b/infrastructure/controllers/base/certmanager/repo.yaml
new file mode 100644
index 0000000..cfc92f4
--- /dev/null
+++ b/infrastructure/controllers/base/certmanager/repo.yaml
@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta3
+kind: HelmRepository
+metadata:
+  name: jetstack
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://charts.jetstack.io
+
diff --git a/monitoring/controllers/base/kube-prometheus-stack/namespace.yaml b/monitoring/controllers/base/kube-prometheus-stack/namespace.yaml
new file mode 100644
index 0000000..178c951
--- /dev/null
+++ b/monitoring/controllers/base/kube-prometheus-stack/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: namespace
+metadata:
+  name: monitoring
diff --git a/monitoring/controllers/staging/values.yaml b/monitoring/controllers/staging/values.yaml
index e8a6cda..05d4c20 100644
--- a/monitoring/controllers/staging/values.yaml
+++ b/monitoring/controllers/staging/values.yaml
@@ -35,11 +35,11 @@ grafana:
   # Ingress configuration
   ingress:
     enabled: true
-    ingressClassName: traefik
+    ingressClassName: 
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt-prod
     hosts:
-      - grafana.mercury-staging.kubecraftlabs.com
+      - grafana.siriussec.com 
     tls:
       - secretName: grafana-tls
         hosts: