diff --git a/apps/metrics-server/Makefile b/apps/metrics-server/Makefile
new file mode 100644
index 00000000..53eb174e
--- /dev/null
+++ b/apps/metrics-server/Makefile
@@ -0,0 +1,23 @@
+SHELL = /usr/bin/env bash
+.PHONY: all render
+
+# Find HelmRelease and Source files
+release := $(shell yq '. | select(.kind=="HelmRelease") | filename' *.yaml)
+source := $(shell yq '. | select(.kind=="HelmRepository") | filename' *.yaml)
+
+# Fetch data from HelmRepository and HelmRelease
+name := $(shell yq '.metadata.name' $(release))
+namespace := $(shell yq '.metadata.namespace' $(release))
+version := $(shell yq '.spec.chart.spec.version' $(release))
+chart := $(shell yq '.spec.chart.spec.chart' $(release))
+values := yq '.spec.values' $(release)
+url := $(shell yq '.spec.url' $(source))
+
+# Run all tasks
+all: render
+
+# Render template with helm (filtering away noisy annotations when diffing)
+render: $(release) $(source)
+	mkdir -p manifests
+	rm -rf manifests/*
+	helm template $(name) $(chart) --repo $(url) --version $(version) --namespace $(namespace) --skip-crds -f <(echo "$$($(values))") | grep -vE "helm.sh/chart|app.kubernetes.io/version" | yq -s '"manifests/" + .kind + "-" + .metadata.name + ".yml"'
diff --git a/apps/metrics-server/manifests/APIService-v1beta1.metrics.k8s.io.yml b/apps/metrics-server/manifests/APIService-v1beta1.metrics.k8s.io.yml
new file mode 100644
index 00000000..aa21be8e
--- /dev/null
+++ b/apps/metrics-server/manifests/APIService-v1beta1.metrics.k8s.io.yml
@@ -0,0 +1,20 @@
+---
+# Source: metrics-server/templates/apiservice.yaml
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1beta1.metrics.k8s.io
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/managed-by: Helm
+spec:
+  group: metrics.k8s.io
+  groupPriorityMinimum: 100
+  insecureSkipTLSVerify: true
+  service:
+    name: metrics-server
+    namespace: metrics-server
+    port: 443
+  version: v1beta1
+  versionPriority: 100
diff --git a/apps/metrics-server/manifests/ClusterRole-system:metrics-server-aggregated-reader.yml b/apps/metrics-server/manifests/ClusterRole-system:metrics-server-aggregated-reader.yml
new file mode 100644
index 00000000..f02523e9
--- /dev/null
+++ b/apps/metrics-server/manifests/ClusterRole-system:metrics-server-aggregated-reader.yml
@@ -0,0 +1,23 @@
+---
+# Source: metrics-server/templates/clusterrole-aggregated-reader.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:metrics-server-aggregated-reader
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/managed-by: Helm
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
diff --git a/apps/metrics-server/manifests/ClusterRole-system:metrics-server.yml b/apps/metrics-server/manifests/ClusterRole-system:metrics-server.yml
new file mode 100644
index 00000000..bed3198d
--- /dev/null
+++ b/apps/metrics-server/manifests/ClusterRole-system:metrics-server.yml
@@ -0,0 +1,28 @@
+---
+# Source: metrics-server/templates/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:metrics-server
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/managed-by: Helm
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes/metrics
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - nodes
+      - namespaces
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
diff --git a/apps/metrics-server/manifests/ClusterRoleBinding-metrics-server:system:auth-delegator.yml b/apps/metrics-server/manifests/ClusterRoleBinding-metrics-server:system:auth-delegator.yml
new file mode 100644
index 00000000..97d4019e
--- /dev/null
+++ b/apps/metrics-server/manifests/ClusterRoleBinding-metrics-server:system:auth-delegator.yml
@@ -0,0 +1,18 @@
+---
+# Source: metrics-server/templates/clusterrolebinding-auth-delegator.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: metrics-server:system:auth-delegator
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: metrics-server
+    namespace: metrics-server
diff --git a/apps/metrics-server/manifests/ClusterRoleBinding-system:metrics-server.yml b/apps/metrics-server/manifests/ClusterRoleBinding-system:metrics-server.yml
new file mode 100644
index 00000000..a6e1d75b
--- /dev/null
+++ b/apps/metrics-server/manifests/ClusterRoleBinding-system:metrics-server.yml
@@ -0,0 +1,18 @@
+---
+# Source: metrics-server/templates/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system:metrics-server
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:metrics-server
+subjects:
+  - kind: ServiceAccount
+    name: metrics-server
+    namespace: metrics-server
diff --git a/apps/metrics-server/manifests/Deployment-metrics-server.yml b/apps/metrics-server/manifests/Deployment-metrics-server.yml
new file mode 100644
index 00000000..1ec10c7b
--- /dev/null
+++ b/apps/metrics-server/manifests/Deployment-metrics-server.yml
@@ -0,0 +1,78 @@
+---
+# Source: metrics-server/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: metrics-server
+  namespace: metrics-server
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: metrics-server
+      app.kubernetes.io/instance: metrics-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: metrics-server
+        app.kubernetes.io/instance: metrics-server
+    spec:
+      serviceAccountName: metrics-server
+      priorityClassName: "system-cluster-critical"
+      containers:
+        - name: metrics-server
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+          image: registry.k8s.io/metrics-server/metrics-server:v0.8.1
+          imagePullPolicy: IfNotPresent
+          args:
+            - --secure-port=10250
+            - --cert-dir=/tmp
+            - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+            - --kubelet-use-node-status-port
+            - --metric-resolution=15s
+            - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+          ports:
+            - name: https
+              protocol: TCP
+              containerPort: 10250
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /livez
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 0
+            periodSeconds: 10
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /readyz
+              port: https
+              scheme: HTTPS
+            initialDelaySeconds: 20
+            periodSeconds: 10
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            limits:
+              memory: 256Mi
+            requests:
+              cpu: 100m
+              memory: 256Mi
+      volumes:
+        - name: tmp
+          emptyDir: {}
diff --git a/apps/metrics-server/manifests/RoleBinding-metrics-server-auth-reader.yml b/apps/metrics-server/manifests/RoleBinding-metrics-server-auth-reader.yml
new file mode 100644
index 00000000..98581f8d
--- /dev/null
+++ b/apps/metrics-server/manifests/RoleBinding-metrics-server-auth-reader.yml
@@ -0,0 +1,19 @@
+---
+# Source: metrics-server/templates/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: metrics-server-auth-reader
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+  - kind: ServiceAccount
+    name: metrics-server
+    namespace: metrics-server
diff --git a/apps/metrics-server/manifests/Service-metrics-server.yml b/apps/metrics-server/manifests/Service-metrics-server.yml
new file mode 100644
index 00000000..bbadd68b
--- /dev/null
+++ b/apps/metrics-server/manifests/Service-metrics-server.yml
@@ -0,0 +1,22 @@
+---
+# Source: metrics-server/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: metrics-server
+  namespace: metrics-server
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: https
+      appProtocol: https
+  selector:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
diff --git a/apps/metrics-server/manifests/ServiceAccount-metrics-server.yml b/apps/metrics-server/manifests/ServiceAccount-metrics-server.yml
new file mode 100644
index 00000000..02b76aca
--- /dev/null
+++ b/apps/metrics-server/manifests/ServiceAccount-metrics-server.yml
@@ -0,0 +1,11 @@
+---
+# Source: metrics-server/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: metrics-server
+  namespace: metrics-server
+  labels:
+    app.kubernetes.io/name: metrics-server
+    app.kubernetes.io/instance: metrics-server
+    app.kubernetes.io/managed-by: Helm