diff --git a/apps/cloudnative-pg-plugin/Chart.yaml b/apps/cloudnative-pg-plugin/Chart.yaml
deleted file mode 100644
index e69de29..0000000
diff --git a/apps/logging/loki/values.yaml b/apps/logging/loki/values.yaml
index d1f19fa..5742dd6 100644
--- a/apps/logging/loki/values.yaml
+++ b/apps/logging/loki/values.yaml
@@ -2,6 +2,14 @@ loki:
   # Single binary deployment mode
   deploymentMode: SingleBinary
   
+  # Disable other deployment modes
+  backend:
+    replicas: 0
+  read:
+    replicas: 0
+  write:
+    replicas: 0
+  
   loki:
     # Authentication
     auth_enabled: false
diff --git a/apps/monitoring/grafana/values.yaml b/apps/monitoring/grafana/values.yaml
index 77573c7..01cc2bc 100644
--- a/apps/monitoring/grafana/values.yaml
+++ b/apps/monitoring/grafana/values.yaml
@@ -105,10 +105,10 @@ grafana:
     
     # Authentication - Authentik OIDC
     auth.generic_oauth:
-      enabled: true
+      enabled: false  # Enable after configuring secret
       name: Authentik
-      client_id: grafana  # TODO: Use secret
-      client_secret: changeme  # TODO: Use secret management
+      client_id: grafana
+      # client_secret should be set via envValueFrom or existingSecret
       scopes: openid profile email
       auth_url: https://auth.noxxos.nl/application/o/authorize/
       token_url: https://auth.noxxos.nl/application/o/token/
diff --git a/apps/validate-manifests.sh b/apps/validate-manifests.sh
index dcd661c..4db9c9c 100755
--- a/apps/validate-manifests.sh
+++ b/apps/validate-manifests.sh
@@ -30,27 +30,29 @@ validate_helm_chart() {
     
     # Check if Chart.yaml exists
     if [ ! -f "$app_path/Chart.yaml" ]; then
-        echo -e "${RED}  ✗ No Chart.yaml found${NC}\n"
-        FAILED=$((FAILED + 1))
-        return 1
+        echo -e "${YELLOW}  → Not a Helm chart - skipping Helm validation${NC}\n"
+        TOTAL=$((TOTAL - 1))
+        return 0
     fi
     
     # Check if dependencies are built (build to temp location if not)
+    local temp_dir=""
     if [ -f "$app_path/Chart.yaml" ] && grep -q "dependencies:" "$app_path/Chart.yaml"; then
         if [ ! -d "$app_path/charts" ]; then
             echo "  → Dependencies not built - building to temporary location..."
             
             # Create temp directory
-            local temp_dir=$(mktemp -d)
-            trap "rm -rf $temp_dir" EXIT
+            temp_dir=$(mktemp -d)
             
-            # Copy chart to temp location
-            cp -r "$app_path" "$temp_dir/"
-            local temp_chart="$temp_dir/$(basename "$app_path")"
+            # Copy chart to temp location (remove trailing slash if present)
+            local clean_path="${app_path%/}"
+            cp -r "$clean_path" "$temp_dir/"
+            local temp_chart="$temp_dir/$(basename "$clean_path")"
             
             # Build dependencies in temp location
             if ! (cd "$temp_chart" && helm dependency build > /dev/null 2>&1); then
                 echo -e "${RED}  ✗ Failed to build dependencies${NC}\n"
+                rm -rf "$temp_dir"
                 FAILED=$((FAILED + 1))
                 return 1
             fi
@@ -72,14 +74,58 @@ validate_helm_chart() {
     
     # Template the chart
     echo "  → Rendering Helm templates..."
-    if ! (cd "$app_path" && helm template "$app_name" . --namespace "$namespace" --validate > /dev/null 2>&1); then
-        echo -e "${RED}  ✗ Helm template failed${NC}"
-        (cd "$app_path" && helm template "$app_name" . --namespace "$namespace" --validate 2>&1 | head -20)
-        echo ""
-        FAILED=$((FAILED + 1))
-        return 1
+    
+    # Try rendering with validation first (redirect to temp file to avoid hanging on large output)
+    local temp_output=$(mktemp)
+    if (cd "$app_path" && helm template "$app_name" . --namespace "$namespace" --validate > "$temp_output" 2>&1); then
+        template_exit=0
+    else
+        template_exit=$?
     fi
     
+    if [ $template_exit -ne 0 ]; then
+        # Check if it's just CRD validation warnings
+        if grep -Eqi "(no matches for kind|ensure CRDs are installed)" "$temp_output"; then
+            echo -e "${YELLOW}  ⚠ Template validation skipped - requires CRDs to be installed${NC}"
+            # Still try to render without validation
+            if (cd "$app_path" && helm template "$app_name" . --namespace "$namespace" > /dev/null 2>&1); then
+                # Rendering works without validation, this is acceptable
+                rm -f "$temp_output"
+                # Continue with other checks...
+            else
+                echo -e "${RED}  ✗ Helm template rendering failed${NC}"
+                head -20 "$temp_output"
+                echo ""
+                rm -f "$temp_output"
+                FAILED=$((FAILED + 1))
+                return 1
+            fi
+        elif grep -qi "exists and cannot be imported into the current release" "$temp_output"; then
+            echo -e "${YELLOW}  ⚠ Resource ownership validation skipped - resources may already exist in cluster${NC}"
+            # This is expected when resources already exist, try without validation
+            if (cd "$app_path" && helm template "$app_name" . --namespace "$namespace" > /dev/null 2>&1); then
+                rm -f "$temp_output"
+                # Continue with other checks...
+            else
+                echo -e "${RED}  ✗ Helm template rendering failed${NC}"
+                head -20 "$temp_output"
+                echo ""
+                rm -f "$temp_output"
+                FAILED=$((FAILED + 1))
+                return 1
+            fi
+        else
+            echo -e "${RED}  ✗ Helm template failed${NC}"
+            head -20 "$temp_output"
+            echo ""
+            rm -f "$temp_output"
+            FAILED=$((FAILED + 1))
+            return 1
+        fi
+    fi
+    
+    rm -f "$temp_output"
+    
     # Validate with kubeval (if installed)
     if command -v kubeval &> /dev/null; then
         echo "  → Validating manifests with kubeval..."
@@ -102,6 +148,11 @@ validate_helm_chart() {
         echo -e "${YELLOW}  ⚠ Warning: No resource requests/limits found${NC}"
     fi
     
+    # Cleanup temp directory if created
+    if [ -n "$temp_dir" ] && [ -d "$temp_dir" ]; then
+        rm -rf "$temp_dir"
+    fi
+    
     echo -e "${GREEN}  ✓ Validation passed${NC}\n"
     PASSED=$((PASSED + 1))
     return 0
@@ -116,9 +167,15 @@ validate_argocd_app() {
     
     echo -e "${YELLOW}[$TOTAL] Validating ArgoCD Application: $app_name${NC}"
     
-    # Check YAML syntax
-    if ! python3 -c "import yaml; yaml.safe_load(open('$app_file'))" 2>/dev/null; then
-        echo -e "${RED}  ✗ Invalid YAML syntax${NC}\n"
+    # Check YAML syntax using yq or basic validation
+    if command -v yq &> /dev/null; then
+        if ! yq eval '.' "$app_file" > /dev/null 2>&1; then
+            echo -e "${RED}  ✗ Invalid YAML syntax${NC}\n"
+            FAILED=$((FAILED + 1))
+            return 1
+        fi
+    elif ! grep -q "^apiVersion:" "$app_file"; then
+        echo -e "${RED}  ✗ Invalid YAML - missing apiVersion${NC}\n"
         FAILED=$((FAILED + 1))
         return 1
     fi
@@ -146,52 +203,67 @@ validate_argocd_app() {
 echo -e "${BLUE}Validating Monitoring Stack...${NC}\n"
 
 # Thanos
-if [ -d "apps/monitoring/thanos" ]; then
-    validate_helm_chart "apps/monitoring/thanos" "monitoring"
-    validate_argocd_app "apps/monitoring/thanos/application.yaml"
+if [ -d "monitoring/thanos" ]; then
+    validate_helm_chart "monitoring/thanos" "monitoring"
+    validate_argocd_app "monitoring/thanos/application.yaml"
 fi
 
 # Prometheus
-if [ -d "apps/monitoring/prometheus" ]; then
-    validate_helm_chart "apps/monitoring/prometheus" "monitoring"
-    validate_argocd_app "apps/monitoring/prometheus/application.yaml"
+if [ -d "monitoring/prometheus" ]; then
+    validate_helm_chart "monitoring/prometheus" "monitoring"
+    validate_argocd_app "monitoring/prometheus/application.yaml"
 fi
 
 # Grafana
-if [ -d "apps/monitoring/grafana" ]; then
-    validate_helm_chart "apps/monitoring/grafana" "monitoring"
-    validate_argocd_app "apps/monitoring/grafana/application.yaml"
+if [ -d "monitoring/grafana" ]; then
+    validate_helm_chart "monitoring/grafana" "monitoring"
+    validate_argocd_app "monitoring/grafana/application.yaml"
 fi
 
 echo -e "${BLUE}Validating Logging Stack...${NC}\n"
 
 # Loki
-if [ -d "apps/logging/loki" ]; then
-    validate_helm_chart "apps/logging/loki" "logging"
-    validate_argocd_app "apps/logging/loki/application.yaml"
+if [ -d "logging/loki" ]; then
+    validate_helm_chart "logging/loki" "logging"
+    validate_argocd_app "logging/loki/application.yaml"
 fi
 
 # Promtail
-if [ -d "apps/logging/promtail" ]; then
-    validate_helm_chart "apps/logging/promtail" "logging"
-    validate_argocd_app "apps/logging/promtail/application.yaml"
+if [ -d "logging/promtail" ]; then
+    validate_helm_chart "logging/promtail" "logging"
+    validate_argocd_app "logging/promtail/application.yaml"
 fi
 
 # Additional apps (if they exist)
 echo -e "${BLUE}Validating Other Applications...${NC}\n"
 
-for app_dir in apps/*/; do
-    app_name=$(basename "$app_dir")
-    if [ -f "$app_dir/Chart.yaml" ] && [ -f "$app_dir/application.yaml" ]; then
-        # Skip if already validated
-        if [[ "$app_name" != "monitoring" ]] && [[ "$app_name" != "logging" ]]; then
-            # Try to extract namespace from application.yaml
-            namespace=$(grep -A 10 "destination:" "$app_dir/application.yaml" | grep "namespace:" | head -1 | awk '{print $2}')
-            [ -z "$namespace" ] && namespace="default"
-            validate_helm_chart "$app_dir" "$namespace"
-            validate_argocd_app "$app_dir/application.yaml"
-        fi
+for app_dir in */; do
+    # Skip special directories
+    if [[ "$app_dir" == "monitoring/" ]] || [[ "$app_dir" == "logging/" ]]; then
+        continue
     fi
+    
+    # Check if it's a Helm chart
+    if [ -f "$app_dir/Chart.yaml" ] && [ -f "$app_dir/application.yaml" ]; then
+        app_name=$(basename "$app_dir")
+        # Try to extract namespace from application.yaml
+        namespace=$(grep -A 10 "destination:" "$app_dir/application.yaml" | grep "namespace:" | head -1 | awk '{print $2}')
+        [ -z "$namespace" ] && namespace="default"
+        validate_helm_chart "$app_dir" "$namespace"
+        validate_argocd_app "$app_dir/application.yaml"
+    fi
+    
+    # Check for nested charts (like ceph/operator, ceph/cluster)
+    for nested_dir in "$app_dir"*/; do
+        if [ -f "$nested_dir/Chart.yaml" ] && [ -f "$nested_dir/application.yaml" ]; then
+            nested_name=$(basename "$nested_dir")
+            # Try to extract namespace from application.yaml
+            namespace=$(grep -A 10 "destination:" "$nested_dir/application.yaml" | grep "namespace:" | head -1 | awk '{print $2}')
+            [ -z "$namespace" ] && namespace="default"
+            validate_helm_chart "$nested_dir" "$namespace"
+            validate_argocd_app "$nested_dir/application.yaml"
+        fi
+    done
 done
 
 # Summary