diff --git a/catalog/copy-images.sh b/catalog/copy-images.sh
index 7bbff34e7..f9f96df34 100755
--- a/catalog/copy-images.sh
+++ b/catalog/copy-images.sh
@@ -99,7 +99,7 @@ $CMD cp --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/cl
$CMD cp --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/cluster-presets:v2026.9.11 $IMAGE_REGISTRY/appscode-charts/cluster-presets:v2026.9.11
$CMD cp --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/cluster-profile-manager:v2026.9.18 $IMAGE_REGISTRY/appscode-charts/cluster-profile-manager:v2026.9.18
$CMD cp --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/cluster-proxy-manager:v2026.6.26 $IMAGE_REGISTRY/appscode-charts/cluster-proxy-manager:v2026.6.26
-$CMD cp --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/config-syncer:v0.15.4 $IMAGE_REGISTRY/appscode-charts/config-syncer:v0.15.4
+$CMD cp --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/config-syncer:v0.15.5 $IMAGE_REGISTRY/appscode-charts/config-syncer:v0.15.5
$CMD cp --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/corekubestashcom-backupbatch-editor:v0.37.0 $IMAGE_REGISTRY/appscode-charts/corekubestashcom-backupbatch-editor:v0.37.0
$CMD cp --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/corekubestashcom-backupblueprint-editor:v0.37.0 $IMAGE_REGISTRY/appscode-charts/corekubestashcom-backupblueprint-editor:v0.37.0
$CMD cp --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/corekubestashcom-backupconfiguration-editor-options:v0.37.0 $IMAGE_REGISTRY/appscode-charts/corekubestashcom-backupconfiguration-editor-options:v0.37.0
diff --git a/catalog/export-images.sh b/catalog/export-images.sh
index f003ae5f1..c34e432a4 100755
--- a/catalog/export-images.sh
+++ b/catalog/export-images.sh
@@ -96,7 +96,7 @@ $CMD pull --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/
$CMD pull --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/cluster-presets:v2026.9.11 images/appscode-charts-cluster-presets-v2026.9.11.tar
$CMD pull --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/cluster-profile-manager:v2026.9.18 images/appscode-charts-cluster-profile-manager-v2026.9.18.tar
$CMD pull --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/cluster-proxy-manager:v2026.6.26 images/appscode-charts-cluster-proxy-manager-v2026.6.26.tar
-$CMD pull --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/config-syncer:v0.15.4 images/appscode-charts-config-syncer-v0.15.4.tar
+$CMD pull --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/config-syncer:v0.15.5 images/appscode-charts-config-syncer-v0.15.5.tar
$CMD pull --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/corekubestashcom-backupbatch-editor:v0.37.0 images/appscode-charts-corekubestashcom-backupbatch-editor-v0.37.0.tar
$CMD pull --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/corekubestashcom-backupblueprint-editor:v0.37.0 images/appscode-charts-corekubestashcom-backupblueprint-editor-v0.37.0.tar
$CMD pull --allow-nondistributable-artifacts --insecure ghcr.io/appscode-charts/corekubestashcom-backupconfiguration-editor-options:v0.37.0 images/appscode-charts-corekubestashcom-backupconfiguration-editor-options-v0.37.0.tar
diff --git a/catalog/feature-charts.yaml b/catalog/feature-charts.yaml
index 64c14bb57..47ff200e5 100644
--- a/catalog/feature-charts.yaml
+++ b/catalog/feature-charts.yaml
@@ -18,7 +18,7 @@
- ghcr.io/appscode-charts/cluster-presets:v2026.9.11
- ghcr.io/appscode-charts/cluster-profile-manager:v2026.9.18
- ghcr.io/appscode-charts/cluster-proxy-manager:v2026.6.26
-- ghcr.io/appscode-charts/config-syncer:v0.15.4
+- ghcr.io/appscode-charts/config-syncer:v0.15.5
- ghcr.io/appscode-charts/crossplane:1.14.0
- ghcr.io/appscode-charts/csi-driver-nfs:v4.7.0
- ghcr.io/appscode-charts/csi-secrets-store-provider-azure:1.5.2
diff --git a/catalog/import-images.sh b/catalog/import-images.sh
index a43adcf43..74059b19e 100755
--- a/catalog/import-images.sh
+++ b/catalog/import-images.sh
@@ -90,7 +90,7 @@ $CMD push --allow-nondistributable-artifacts --insecure images/appscode-charts-c
$CMD push --allow-nondistributable-artifacts --insecure images/appscode-charts-cluster-presets-v2026.9.11.tar $IMAGE_REGISTRY/appscode-charts/cluster-presets:v2026.9.11
$CMD push --allow-nondistributable-artifacts --insecure images/appscode-charts-cluster-profile-manager-v2026.9.18.tar $IMAGE_REGISTRY/appscode-charts/cluster-profile-manager:v2026.9.18
$CMD push --allow-nondistributable-artifacts --insecure images/appscode-charts-cluster-proxy-manager-v2026.6.26.tar $IMAGE_REGISTRY/appscode-charts/cluster-proxy-manager:v2026.6.26
-$CMD push --allow-nondistributable-artifacts --insecure images/appscode-charts-config-syncer-v0.15.4.tar $IMAGE_REGISTRY/appscode-charts/config-syncer:v0.15.4
+$CMD push --allow-nondistributable-artifacts --insecure images/appscode-charts-config-syncer-v0.15.5.tar $IMAGE_REGISTRY/appscode-charts/config-syncer:v0.15.5
$CMD push --allow-nondistributable-artifacts --insecure images/appscode-charts-corekubestashcom-backupbatch-editor-v0.37.0.tar $IMAGE_REGISTRY/appscode-charts/corekubestashcom-backupbatch-editor:v0.37.0
$CMD push --allow-nondistributable-artifacts --insecure images/appscode-charts-corekubestashcom-backupblueprint-editor-v0.37.0.tar $IMAGE_REGISTRY/appscode-charts/corekubestashcom-backupblueprint-editor:v0.37.0
$CMD push --allow-nondistributable-artifacts --insecure images/appscode-charts-corekubestashcom-backupconfiguration-editor-options-v0.37.0.tar $IMAGE_REGISTRY/appscode-charts/corekubestashcom-backupconfiguration-editor-options:v0.37.0
diff --git a/catalog/import-into-k3s.sh b/catalog/import-into-k3s.sh
index c4d75ca95..4ad7402ca 100755
--- a/catalog/import-into-k3s.sh
+++ b/catalog/import-into-k3s.sh
@@ -88,7 +88,7 @@ k3s ctr images import images/appscode-charts-cluster-manager-spoke-v2026.2.16.ta
k3s ctr images import images/appscode-charts-cluster-presets-v2026.9.11.tar
k3s ctr images import images/appscode-charts-cluster-profile-manager-v2026.9.18.tar
k3s ctr images import images/appscode-charts-cluster-proxy-manager-v2026.6.26.tar
-k3s ctr images import images/appscode-charts-config-syncer-v0.15.4.tar
+k3s ctr images import images/appscode-charts-config-syncer-v0.15.5.tar
k3s ctr images import images/appscode-charts-corekubestashcom-backupbatch-editor-v0.37.0.tar
k3s ctr images import images/appscode-charts-corekubestashcom-backupblueprint-editor-v0.37.0.tar
k3s ctr images import images/appscode-charts-corekubestashcom-backupconfiguration-editor-options-v0.37.0.tar
diff --git a/charts/ace-installer-certified-crds/README.md b/charts/ace-installer-certified-crds/README.md
index e602ef96c..5da279188 100644
--- a/charts/ace-installer-certified-crds/README.md
+++ b/charts/ace-installer-certified-crds/README.md
@@ -81,6 +81,8 @@ The following table lists the configurable parameters of the `ace-installer-cert
| helm.releases.cert-manager.version | | "v1.19.3" |
| helm.releases.cert-manager-csi-driver-cacerts.enabled | | true |
| helm.releases.cert-manager-csi-driver-cacerts.version | | "v2026.9.18" |
+| helm.releases.config-syncer.enabled | | true |
+| helm.releases.config-syncer.version | | "v0.15.5" |
| helm.releases.external-dns-operator.enabled | | true |
| helm.releases.external-dns-operator.version | | "v2026.6.22" |
| helm.releases.flux2.enabled | | false |
diff --git a/charts/ace-installer-certified-crds/values.yaml b/charts/ace-installer-certified-crds/values.yaml
index 78ff4f703..01834e7a0 100644
--- a/charts/ace-installer-certified-crds/values.yaml
+++ b/charts/ace-installer-certified-crds/values.yaml
@@ -74,6 +74,9 @@ helm:
cert-manager-csi-driver-cacerts:
enabled: true
version: "v2026.9.18"
+ config-syncer:
+ enabled: true
+ version: "v0.15.5"
external-dns-operator:
enabled: true
version: "v2026.6.22"
diff --git a/charts/ace-installer-certified/Chart.lock b/charts/ace-installer-certified/Chart.lock
deleted file mode 100644
index 3e2e448ab..000000000
--- a/charts/ace-installer-certified/Chart.lock
+++ /dev/null
@@ -1,6 +0,0 @@
-dependencies:
-- name: regcache
- repository: file://../regcache
- version: v2026.9.11
-digest: sha256:b6e6ad3e41e85a36201a3f559dd110602226f71a27f9c96c2170fa36d4434f2f
-generated: "2026-09-08T11:25:35.419697757+06:00"
diff --git a/charts/ace-installer-certified/README.md b/charts/ace-installer-certified/README.md
index 250730008..c72052907 100644
--- a/charts/ace-installer-certified/README.md
+++ b/charts/ace-installer-certified/README.md
@@ -81,6 +81,8 @@ The following table lists the configurable parameters of the `ace-installer-cert
| helm.releases.cert-manager.version | | "v1.19.3" |
| helm.releases.cert-manager-csi-driver-cacerts.enabled | | true |
| helm.releases.cert-manager-csi-driver-cacerts.version | | "v2026.9.18" |
+| helm.releases.config-syncer.enabled | | true |
+| helm.releases.config-syncer.version | | "v0.15.5" |
| helm.releases.external-dns-operator.enabled | | true |
| helm.releases.external-dns-operator.version | | "v2026.6.22" |
| helm.releases.flux2.enabled | | false |
diff --git a/charts/ace-installer-certified/resourcetemplates/helmreleases/ace/ace.yaml b/charts/ace-installer-certified/resourcetemplates/helmreleases/ace/ace.yaml
index 278cd253c..8f425b65c 100644
--- a/charts/ace-installer-certified/resourcetemplates/helmreleases/ace/ace.yaml
+++ b/charts/ace-installer-certified/resourcetemplates/helmreleases/ace/ace.yaml
@@ -34,6 +34,10 @@ spec:
{{- end }}
- name: reloader
namespace: {{ $.Release.Namespace }}
+ {{- if (dig "config-syncer" "enabled" false $.Values.helm.releases) }}
+ - name: config-syncer
+ namespace: {{ $.Release.Namespace }}
+ {{- end }}
{{- if (dig "service-vault" "enabled" false $.Values.helm.releases) }}
- name: service-vault
namespace: {{ $.Release.Namespace }}
diff --git a/charts/ace-installer-certified/templates/featuresets/opscenter-secret-management/config-syncer.yaml b/charts/ace-installer-certified/templates/featuresets/opscenter-secret-management/config-syncer.yaml
new file mode 100644
index 000000000..915d0bb16
--- /dev/null
+++ b/charts/ace-installer-certified/templates/featuresets/opscenter-secret-management/config-syncer.yaml
@@ -0,0 +1,53 @@
+{{- with (index .Values "helm" "releases" "config-syncer") }}
+{{- if .enabled }}
+
+{{ $defaults := dict "mode" "oss" "registryFQDN" (include "registry.ghcr" $) }}
+
+{{ $vals := dig "values" dict . }}
+{{ $vals = mergeOverwrite $defaults $vals }}
+
+{{- if eq (include "distro.openshift" $) "true" }}
+{{ $vals = mergeOverwrite $vals (pick ($.Values.options | fromYaml) "distro") }}
+{{- end }}
+
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: config-syncer
+ namespace: {{ $.Release.Namespace }}
+ labels:
+ app.kubernetes.io/component: config-syncer
+ app.kubernetes.io/part-of: opscenter-secret-management
+spec:
+ interval: 5m
+ timeout: 30m
+ releaseName: config-syncer
+ targetNamespace: kubeops
+ storageNamespace: kubeops
+ install:
+ createNamespace: {{ $.Values.helm.createNamespace }}
+ # crds: CreateReplace
+ remediation:
+ retries: -1
+ upgrade:
+ crds: CreateReplace
+ remediation:
+ retries: -1
+ dependsOn:
+ - name: opscenter-features
+ namespace: {{ $.Release.Namespace }}
+ chart:
+ spec:
+ chart: config-syncer
+ version: {{ .version | quote }}
+ interval: 60m
+ sourceRef:
+ kind: HelmRepository
+ name: appscode-charts-oci
+ namespace: {{ $.Release.Namespace }}
+{{- with $vals }}
+ {{- dict "values" . | toYaml | nindent 2 }}
+{{- end }}
+
+{{- end }}
+{{- end }}
diff --git a/charts/ace-installer-certified/values.yaml b/charts/ace-installer-certified/values.yaml
index 78ff4f703..01834e7a0 100644
--- a/charts/ace-installer-certified/values.yaml
+++ b/charts/ace-installer-certified/values.yaml
@@ -74,6 +74,9 @@ helm:
cert-manager-csi-driver-cacerts:
enabled: true
version: "v2026.9.18"
+ config-syncer:
+ enabled: true
+ version: "v0.15.5"
external-dns-operator:
enabled: true
version: "v2026.6.22"
diff --git a/charts/ace-installer/README.md b/charts/ace-installer/README.md
index 4e21cada4..9069e6bf7 100644
--- a/charts/ace-installer/README.md
+++ b/charts/ace-installer/README.md
@@ -81,6 +81,8 @@ The following table lists the configurable parameters of the `ace-installer` cha
| helm.releases.cert-manager.version | | "v1.19.3" |
| helm.releases.cert-manager-csi-driver-cacerts.enabled | | true |
| helm.releases.cert-manager-csi-driver-cacerts.version | | "v2026.9.18" |
+| helm.releases.config-syncer.enabled | | true |
+| helm.releases.config-syncer.version | | "v0.15.5" |
| helm.releases.external-dns-operator.enabled | | true |
| helm.releases.external-dns-operator.version | | "v2026.6.22" |
| helm.releases.flux2.enabled | | false |
diff --git a/charts/ace-installer/resourcetemplates/helmreleases/ace/ace.yaml b/charts/ace-installer/resourcetemplates/helmreleases/ace/ace.yaml
index 278cd253c..8f425b65c 100644
--- a/charts/ace-installer/resourcetemplates/helmreleases/ace/ace.yaml
+++ b/charts/ace-installer/resourcetemplates/helmreleases/ace/ace.yaml
@@ -34,6 +34,10 @@ spec:
{{- end }}
- name: reloader
namespace: {{ $.Release.Namespace }}
+ {{- if (dig "config-syncer" "enabled" false $.Values.helm.releases) }}
+ - name: config-syncer
+ namespace: {{ $.Release.Namespace }}
+ {{- end }}
{{- if (dig "service-vault" "enabled" false $.Values.helm.releases) }}
- name: service-vault
namespace: {{ $.Release.Namespace }}
diff --git a/charts/ace-installer/templates/featuresets/opscenter-secret-management/config-syncer.yaml b/charts/ace-installer/templates/featuresets/opscenter-secret-management/config-syncer.yaml
new file mode 100644
index 000000000..915d0bb16
--- /dev/null
+++ b/charts/ace-installer/templates/featuresets/opscenter-secret-management/config-syncer.yaml
@@ -0,0 +1,53 @@
+{{- with (index .Values "helm" "releases" "config-syncer") }}
+{{- if .enabled }}
+
+{{ $defaults := dict "mode" "oss" "registryFQDN" (include "registry.ghcr" $) }}
+
+{{ $vals := dig "values" dict . }}
+{{ $vals = mergeOverwrite $defaults $vals }}
+
+{{- if eq (include "distro.openshift" $) "true" }}
+{{ $vals = mergeOverwrite $vals (pick ($.Values.options | fromYaml) "distro") }}
+{{- end }}
+
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: config-syncer
+ namespace: {{ $.Release.Namespace }}
+ labels:
+ app.kubernetes.io/component: config-syncer
+ app.kubernetes.io/part-of: opscenter-secret-management
+spec:
+ interval: 5m
+ timeout: 30m
+ releaseName: config-syncer
+ targetNamespace: kubeops
+ storageNamespace: kubeops
+ install:
+ createNamespace: {{ $.Values.helm.createNamespace }}
+ # crds: CreateReplace
+ remediation:
+ retries: -1
+ upgrade:
+ crds: CreateReplace
+ remediation:
+ retries: -1
+ dependsOn:
+ - name: opscenter-features
+ namespace: {{ $.Release.Namespace }}
+ chart:
+ spec:
+ chart: config-syncer
+ version: {{ .version | quote }}
+ interval: 60m
+ sourceRef:
+ kind: HelmRepository
+ name: appscode-charts-oci
+ namespace: {{ $.Release.Namespace }}
+{{- with $vals }}
+ {{- dict "values" . | toYaml | nindent 2 }}
+{{- end }}
+
+{{- end }}
+{{- end }}
diff --git a/charts/ace-installer/values.yaml b/charts/ace-installer/values.yaml
index 78ff4f703..01834e7a0 100644
--- a/charts/ace-installer/values.yaml
+++ b/charts/ace-installer/values.yaml
@@ -74,6 +74,9 @@ helm:
cert-manager-csi-driver-cacerts:
enabled: true
version: "v2026.9.18"
+ config-syncer:
+ enabled: true
+ version: "v0.15.5"
external-dns-operator:
enabled: true
version: "v2026.6.22"
diff --git a/charts/opscenter-features/README.md b/charts/opscenter-features/README.md
index 32fd576ab..2940b2a6d 100644
--- a/charts/opscenter-features/README.md
+++ b/charts/opscenter-features/README.md
@@ -85,7 +85,7 @@ The following table lists the configurable parameters of the `opscenter-features
| helm.releases.cert-manager-csi-driver-cacerts.version | | "v2026.9.18" |
| helm.releases.cluster-autoscaler.version | | "9.29.0" |
| helm.releases.cluster-presets.version | | "v2026.9.11" |
-| helm.releases.config-syncer.version | | "v0.15.4" |
+| helm.releases.config-syncer.version | | "v0.15.5" |
| helm.releases.crossplane.version | | "1.14.0" |
| helm.releases.csi-driver-nfs.version | | "v4.7.0" |
| helm.releases.external-dns-operator.version | | "v2026.6.22" |
diff --git a/charts/opscenter-features/templates/featuresets/opscenter-secret-management/config-syncer.yaml b/charts/opscenter-features/templates/featuresets/opscenter-secret-management/config-syncer.yaml
index 74f1229e6..3ce30f0ed 100644
--- a/charts/opscenter-features/templates/featuresets/opscenter-secret-management/config-syncer.yaml
+++ b/charts/opscenter-features/templates/featuresets/opscenter-secret-management/config-syncer.yaml
@@ -1,5 +1,5 @@
{{ $defaults := printf `
-mode: enterprise
+mode: oss
registryFQDN: %q
`
(include "registry.ghcr" $)
diff --git a/charts/opscenter-features/values.yaml b/charts/opscenter-features/values.yaml
index 9914074aa..6967bd144 100644
--- a/charts/opscenter-features/values.yaml
+++ b/charts/opscenter-features/values.yaml
@@ -85,7 +85,7 @@ helm:
cluster-presets:
version: "v2026.9.11"
config-syncer:
- version: "v0.15.4"
+ version: "v0.15.5"
crossplane:
version: "1.14.0"
csi-driver-nfs:
diff --git a/charts/service-gateway/templates/gateway-tls/certificate.yaml b/charts/service-gateway/templates/gateway-tls/certificate.yaml
index 4ea7047f0..e4d3aab26 100644
--- a/charts/service-gateway/templates/gateway-tls/certificate.yaml
+++ b/charts/service-gateway/templates/gateway-tls/certificate.yaml
@@ -12,6 +12,9 @@ spec:
secretTemplate:
annotations:
vcluster.loft.sh/force-sync: "true"
+ {{- if and (eq (dig "catalog.appscode.com/is-default-gatewayclass" "" (.Values.gatewayClass.annotations | default dict)) "true") (ne .Release.Namespace "monitoring") (not (lookup "gateway.networking.k8s.io/v1" "GatewayClass" "" "monitoring")) }}
+ kubed.appscode.com/sync: "kubernetes.io/metadata.name=monitoring"
+ {{- end }}
issuerRef:
group: cert-manager.io
kind: Issuer