From 30a0c762e141a71031cad471c12236c2e537ddec Mon Sep 17 00:00:00 2001
From: Graham Beckley <gbeckley@mozilla.com>
Date: Wed, 25 Mar 2026 11:04:20 -0400
Subject: [PATCH 1/6] feat: support security policy in mozcloud-ingress

---
 mozcloud-ingress/application/Chart.yaml       |  4 ++--
 mozcloud-ingress/application/README.md        |  6 ++---
 .../tests/basic-configuration_test.yaml       |  2 ++
 .../security-policy-configuration_test.yaml   | 24 +++++++++++++++++++
 .../values/security-policy-configuration.yaml | 14 +++++++++++
 .../application/values.schema.json            |  3 ++-
 mozcloud-ingress/application/values.yaml      |  8 +++++--
 mozcloud-ingress/library/Chart.yaml           |  2 +-
 mozcloud-ingress/library/README.md            |  4 ++--
 .../library/templates/_helpers.tpl            |  3 +++
 10 files changed, 59 insertions(+), 11 deletions(-)
 create mode 100644 mozcloud-ingress/application/tests/security-policy-configuration_test.yaml
 create mode 100644 mozcloud-ingress/application/tests/values/security-policy-configuration.yaml

diff --git a/mozcloud-ingress/application/Chart.yaml b/mozcloud-ingress/application/Chart.yaml
index d80ff934..1231b953 100644
--- a/mozcloud-ingress/application/Chart.yaml
+++ b/mozcloud-ingress/application/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.1
+version: 0.6.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -25,5 +25,5 @@ appVersion: 0.4.2
 
 dependencies:
   - name: mozcloud-ingress-lib
-    version: 0.6.1
+    version: 0.7.0
     repository: file://../library
diff --git a/mozcloud-ingress/application/README.md b/mozcloud-ingress/application/README.md
index 17d6a71f..8816b55c 100644
--- a/mozcloud-ingress/application/README.md
+++ b/mozcloud-ingress/application/README.md
@@ -1,6 +1,6 @@
 # mozcloud-ingress
 
-![Version: 0.5.1](https://img.shields.io/badge/Version-0.5.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.6.0](https://img.shields.io/badge/Version-0.6.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart that creates ingress and supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-ingress
-    version: ~0.5.1
+    version: ~0.6.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -35,7 +35,7 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://../library | mozcloud-ingress-lib | 0.6.1 |
+| file://../library | mozcloud-ingress-lib | 0.7.0 |
 
 ## Values
 
diff --git a/mozcloud-ingress/application/tests/basic-configuration_test.yaml b/mozcloud-ingress/application/tests/basic-configuration_test.yaml
index 79e4e826..974b51ec 100644
--- a/mozcloud-ingress/application/tests/basic-configuration_test.yaml
+++ b/mozcloud-ingress/application/tests/basic-configuration_test.yaml
@@ -30,6 +30,8 @@ tests:
             logging:
               enable: true
               sampleRate: 0.1
+      - notExists:
+          path: spec.securityPolicy
   - it: Frontend is configured correctly
     template: frontendconfig.yaml
     documentSelector:
diff --git a/mozcloud-ingress/application/tests/security-policy-configuration_test.yaml b/mozcloud-ingress/application/tests/security-policy-configuration_test.yaml
new file mode 100644
index 00000000..d87bc5b2
--- /dev/null
+++ b/mozcloud-ingress/application/tests/security-policy-configuration_test.yaml
@@ -0,0 +1,24 @@
+---
+suite: "mozcloud-ingress: Security policy configuration"
+release:
+  name: mozcloud-test
+  namespace: mozcloud-test-dev
+chart:
+  version: 1.0.0
+values:
+  - values/globals.yaml
+  - values/security-policy-configuration.yaml
+tests:
+  - it: Ensure no failures occur
+    asserts:
+      - notFailedTemplate: {}
+  - it: BackendConfig includes securityPolicy as an object
+    template: backendconfig.yaml
+    documentSelector:
+      path: $[?(@.kind == "BackendConfig")].metadata.name
+      value: test-ingress
+    asserts:
+      - equal:
+          path: spec.securityPolicy
+          value:
+            name: my-app-cloud-armor-policy
diff --git a/mozcloud-ingress/application/tests/values/security-policy-configuration.yaml b/mozcloud-ingress/application/tests/values/security-policy-configuration.yaml
new file mode 100644
index 00000000..ea03b141
--- /dev/null
+++ b/mozcloud-ingress/application/tests/values/security-policy-configuration.yaml
@@ -0,0 +1,14 @@
+---
+backendConfig:
+  securityPolicy: my-app-cloud-armor-policy
+ingresses:
+  test-ingress:
+    staticIpName: mozcloud-test-dev-ip-v4
+    hosts:
+      - domains:
+          - test-service.dev.test-domain.com
+        paths:
+          - path: /
+            backend:
+              service:
+                port: 8080
diff --git a/mozcloud-ingress/application/values.schema.json b/mozcloud-ingress/application/values.schema.json
index 3e38a4f3..3210a8f7 100644
--- a/mozcloud-ingress/application/values.schema.json
+++ b/mozcloud-ingress/application/values.schema.json
@@ -285,7 +285,8 @@
           "$ref": "#/$defs/logging"
         },
         "securityPolicy": {
-          "type": "string"
+          "type": "string",
+          "description": "Cloud Armor security policy name to attach to the load balancer backend. For migration of existing applications only — new applications should use Fastly for WAF instead."
         },
         "sessionAffinity": {
           "type": "object",
diff --git a/mozcloud-ingress/application/values.yaml b/mozcloud-ingress/application/values.yaml
index a0345033..ca636a8b 100644
--- a/mozcloud-ingress/application/values.yaml
+++ b/mozcloud-ingress/application/values.yaml
@@ -100,8 +100,12 @@ backendConfig:
     # Ranges from 0.0 (0%) to 1.0 (100%).
     sampleRate: 0.1
 
-  # Security policy to use with the GCLB. This should match the name of a rule
-  # in CloudArmor. Defaults to: {{ $.Values.app_code }}-policy
+  # Cloud Armor security policy to attach to the load balancer backend. This
+  # should match the name of an existing Cloud Armor policy in GCP.
+  #
+  # NOTE: This option exists only to support migration of existing applications
+  # that already use Cloud Armor. New applications should NOT use this — use
+  # Fastly for WAF instead.
   #securityPolicy:
 
   # Optionally configures generated cookie affinity.
diff --git a/mozcloud-ingress/library/Chart.yaml b/mozcloud-ingress/library/Chart.yaml
index fef91bdf..acd4bb8c 100644
--- a/mozcloud-ingress/library/Chart.yaml
+++ b/mozcloud-ingress/library/Chart.yaml
@@ -15,7 +15,7 @@ type: library
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.1
+version: 0.7.0
 
 dependencies:
   - name: mozcloud-labels-lib
diff --git a/mozcloud-ingress/library/README.md b/mozcloud-ingress/library/README.md
index 5a27fee4..b1c56ace 100644
--- a/mozcloud-ingress/library/README.md
+++ b/mozcloud-ingress/library/README.md
@@ -1,6 +1,6 @@
 # mozcloud-ingress-lib
 
-![Version: 0.6.1](https://img.shields.io/badge/Version-0.6.1-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
+![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
 
 A library chart that creates ingress and supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-ingress-lib
-    version: ~0.6.1
+    version: ~0.7.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
diff --git a/mozcloud-ingress/library/templates/_helpers.tpl b/mozcloud-ingress/library/templates/_helpers.tpl
index d8869678..ad27fecb 100644
--- a/mozcloud-ingress/library/templates/_helpers.tpl
+++ b/mozcloud-ingress/library/templates/_helpers.tpl
@@ -103,6 +103,9 @@ BackendConfig template helpers
   {{- range $host := $ingress.hosts -}}
     {{- range $path := $host.paths -}}
       {{- $backend := mergeOverwrite $defaults (default (dict) $path.backend.config) -}}
+      {{- if kindIs "string" $backend.securityPolicy -}}
+        {{- $_ := set $backend "securityPolicy" (dict "name" $backend.securityPolicy) -}}
+      {{- end -}}
       {{/* If a backend name is not specified, use the service name for the backend */}}
       {{- $params := mergeOverwrite $context (dict "backendConfig" $backend "ingressConfig" $ingress "backendService" $path.backend.service) -}}
       {{- if $name_override -}}

From 5cfea1a65087dbc5f1351917f73a992655f13489 Mon Sep 17 00:00:00 2001
From: Graham Beckley <gbeckley@mozilla.com>
Date: Wed, 25 Mar 2026 11:04:43 -0400
Subject: [PATCH 2/6] feat: support security policy in mozcloud-gateway

---
 mozcloud-gateway/application/Chart.yaml       |  4 +--
 mozcloud-gateway/application/README.md        |  6 ++---
 .../tests/basic-configuration_test.yaml       |  2 ++
 .../security-policy-configuration_test.yaml   | 23 ++++++++++++++++
 .../values/security-policy-configuration.yaml | 26 +++++++++++++++++++
 .../application/values.schema.json            |  4 +++
 mozcloud-gateway/application/values.yaml      |  8 ++++++
 mozcloud-gateway/library/Chart.yaml           |  2 +-
 mozcloud-gateway/library/README.md            |  4 +--
 .../library/templates/_backendpolicy.yaml     |  3 +++
 10 files changed, 74 insertions(+), 8 deletions(-)
 create mode 100644 mozcloud-gateway/application/tests/security-policy-configuration_test.yaml
 create mode 100644 mozcloud-gateway/application/tests/values/security-policy-configuration.yaml

diff --git a/mozcloud-gateway/application/Chart.yaml b/mozcloud-gateway/application/Chart.yaml
index 71e7c5d8..c8934f4d 100644
--- a/mozcloud-gateway/application/Chart.yaml
+++ b/mozcloud-gateway/application/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.29
+version: 0.5.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -26,5 +26,5 @@ appVersion: 0.4.2
 
 dependencies:
   - name: mozcloud-gateway-lib
-    version: 0.5.0
+    version: 0.6.0
     repository: file://../library
diff --git a/mozcloud-gateway/application/README.md b/mozcloud-gateway/application/README.md
index 10edcf74..a48b4b63 100644
--- a/mozcloud-gateway/application/README.md
+++ b/mozcloud-gateway/application/README.md
@@ -1,6 +1,6 @@
 # mozcloud-gateway
 
-![Version: 0.4.29](https://img.shields.io/badge/Version-0.4.29-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart that creates gateways and supporting Gateway API resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-gateway
-    version: ~0.4.29
+    version: ~0.5.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -35,7 +35,7 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://../library | mozcloud-gateway-lib | 0.5.0 |
+| file://../library | mozcloud-gateway-lib | 0.6.0 |
 
 ## Values
 
diff --git a/mozcloud-gateway/application/tests/basic-configuration_test.yaml b/mozcloud-gateway/application/tests/basic-configuration_test.yaml
index a0a5002a..8bac04be 100644
--- a/mozcloud-gateway/application/tests/basic-configuration_test.yaml
+++ b/mozcloud-gateway/application/tests/basic-configuration_test.yaml
@@ -33,6 +33,8 @@ tests:
       - equal:
           path: spec.targetRef.name
           value: test-service
+      - notExists:
+          path: spec.default.securityPolicy
   - it: External gateway is configured correctly
     template: gateway.yaml
     documentSelector:
diff --git a/mozcloud-gateway/application/tests/security-policy-configuration_test.yaml b/mozcloud-gateway/application/tests/security-policy-configuration_test.yaml
new file mode 100644
index 00000000..acf8b24c
--- /dev/null
+++ b/mozcloud-gateway/application/tests/security-policy-configuration_test.yaml
@@ -0,0 +1,23 @@
+---
+suite: "mozcloud-gateway: Security policy configuration"
+release:
+  name: mozcloud-test
+  namespace: mozcloud-test-dev
+chart:
+  version: 1.0.0
+values:
+  - values/globals.yaml
+  - values/security-policy-configuration.yaml
+tests:
+  - it: Ensure no failures occur
+    asserts:
+      - notFailedTemplate: {}
+  - it: GCP backend policy includes securityPolicy
+    template: backendpolicy.yaml
+    documentSelector:
+      path: $[?(@.kind == "GCPBackendPolicy")].metadata.name
+      value: test-service
+    asserts:
+      - equal:
+          path: spec.default.securityPolicy
+          value: my-app-cloud-armor-policy
diff --git a/mozcloud-gateway/application/tests/values/security-policy-configuration.yaml b/mozcloud-gateway/application/tests/values/security-policy-configuration.yaml
new file mode 100644
index 00000000..3b53cd9b
--- /dev/null
+++ b/mozcloud-gateway/application/tests/values/security-policy-configuration.yaml
@@ -0,0 +1,26 @@
+---
+backends:
+  test-service:
+    service:
+      port: 8080
+backendPolicy:
+  securityPolicy: my-app-cloud-armor-policy
+gateway:
+  gateways:
+    test-gateway:
+      addresses:
+        - mozcloud-test-dev-ip-v4
+      tls:
+        certs:
+          - mozcloud-test-nonprod-dev
+        type: certmap
+httpRoute:
+  httpRoutes:
+    test-httproute:
+      gatewayRefs:
+        - name: test-gateway
+          section: https
+      rules:
+        - backendRefs:
+            - name: test-service
+              port: 8080
diff --git a/mozcloud-gateway/application/values.schema.json b/mozcloud-gateway/application/values.schema.json
index 035c2c1b..28c97e79 100644
--- a/mozcloud-gateway/application/values.schema.json
+++ b/mozcloud-gateway/application/values.schema.json
@@ -189,6 +189,10 @@
         },
         "timeoutSec": {
           "type": "integer"
+        },
+        "securityPolicy": {
+          "type": "string",
+          "description": "Cloud Armor security policy name to attach to the load balancer backend. For migration of existing applications only — new applications should use Fastly for WAF instead."
         }
       }
     },
diff --git a/mozcloud-gateway/application/values.yaml b/mozcloud-gateway/application/values.yaml
index 4b6dd642..5c7af976 100644
--- a/mozcloud-gateway/application/values.yaml
+++ b/mozcloud-gateway/application/values.yaml
@@ -47,6 +47,14 @@ backendPolicy:
   # Backend service timeout period in seconds.
   #timeoutSec: 30
 
+  # Cloud Armor security policy to attach to the load balancer backend. This
+  # should match the name of an existing Cloud Armor policy in GCP.
+  #
+  # NOTE: This option exists only to support migration of existing applications
+  # that already use Cloud Armor. New applications should NOT use this — use
+  # Fastly for WAF instead.
+  #securityPolicy:
+
 # Defines the backend services to create, backend policies, and healthchecks.
 backends:
   # The name of your backend and all related components. "mozcloud-gateway" is
diff --git a/mozcloud-gateway/library/Chart.yaml b/mozcloud-gateway/library/Chart.yaml
index 178ca5ac..19bf56f0 100644
--- a/mozcloud-gateway/library/Chart.yaml
+++ b/mozcloud-gateway/library/Chart.yaml
@@ -16,7 +16,7 @@ type: library
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.0
+version: 0.6.0
 
 dependencies:
   - name: mozcloud-labels-lib
diff --git a/mozcloud-gateway/library/README.md b/mozcloud-gateway/library/README.md
index bd3de1bc..9e95d6ad 100644
--- a/mozcloud-gateway/library/README.md
+++ b/mozcloud-gateway/library/README.md
@@ -1,6 +1,6 @@
 # mozcloud-gateway-lib
 
-![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
+![Version: 0.6.0](https://img.shields.io/badge/Version-0.6.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
 
 A library chart that creates gateways and supporting Gateway API resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-gateway-lib
-    version: ~0.5.0
+    version: ~0.6.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
diff --git a/mozcloud-gateway/library/templates/_backendpolicy.yaml b/mozcloud-gateway/library/templates/_backendpolicy.yaml
index 0a57abb4..8354200f 100644
--- a/mozcloud-gateway/library/templates/_backendpolicy.yaml
+++ b/mozcloud-gateway/library/templates/_backendpolicy.yaml
@@ -34,6 +34,9 @@ spec:
     {{- if $config.timeoutSec }}
     timeoutSec: {{ $config.timeoutSec }}
     {{- end }}
+    {{- if $config.securityPolicy }}
+    securityPolicy: {{ $config.securityPolicy }}
+    {{- end }}
   targetRef:
   {{- if $backend_policy.config.targetRef  }}
     {{- $backend_policy.config.targetRef | toYaml | nindent 4 }}

From c5acd534a25a5507d7b1e7963a1f003604e6706a Mon Sep 17 00:00:00 2001
From: Graham Beckley <gbeckley@mozilla.com>
Date: Wed, 25 Mar 2026 11:04:55 -0400
Subject: [PATCH 3/6] feat: support security policy in mozcloud chart

---
 mozcloud/application/Chart.yaml               |  6 ++---
 mozcloud/application/README.md                |  8 +++---
 .../templates/gateway/backend.yaml            |  3 +++
 .../basic-gateway-configuration_test.yaml     |  2 ++
 .../security-policy-configuration_test.yaml   | 26 +++++++++++++++++++
 .../values/security-policy-configuration.yaml | 15 +++++++++++
 mozcloud/application/values.schema.json       |  8 ++++++
 mozcloud/application/values.yaml              |  8 ++++++
 8 files changed, 69 insertions(+), 7 deletions(-)
 create mode 100644 mozcloud/application/tests/security-policy-configuration_test.yaml
 create mode 100644 mozcloud/application/tests/values/security-policy-configuration.yaml

diff --git a/mozcloud/application/Chart.yaml b/mozcloud/application/Chart.yaml
index c2c396da..20da35c6 100644
--- a/mozcloud/application/Chart.yaml
+++ b/mozcloud/application/Chart.yaml
@@ -2,14 +2,14 @@ apiVersion: v2
 name: mozcloud
 description: Opinionated application chart used to deploy MozCloud Kubernetes 
   resources supporting resources
-version: 0.13.2
+version: 0.14.0
 type: application
 dependencies:
   - name: mozcloud-gateway-lib
-    version: 0.5.0
+    version: 0.6.0
     repository: file://../../mozcloud-gateway/library
   - name: mozcloud-ingress-lib
-    version: 0.6.1
+    version: 0.7.0
     repository: file://../../mozcloud-ingress/library
   - name: mozcloud-labels-lib
     version: 0.3.16
diff --git a/mozcloud/application/README.md b/mozcloud/application/README.md
index 8349a374..73e3ad50 100644
--- a/mozcloud/application/README.md
+++ b/mozcloud/application/README.md
@@ -1,6 +1,6 @@
 # mozcloud
 
-![Version: 0.13.2](https://img.shields.io/badge/Version-0.13.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.14.0](https://img.shields.io/badge/Version-0.14.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Opinionated application chart used to deploy MozCloud Kubernetes resources supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud
-    version: ~0.13.2
+    version: ~0.14.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -35,8 +35,8 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://../../mozcloud-gateway/library | mozcloud-gateway-lib | 0.5.0 |
-| file://../../mozcloud-ingress/library | mozcloud-ingress-lib | 0.6.1 |
+| file://../../mozcloud-gateway/library | mozcloud-gateway-lib | 0.6.0 |
+| file://../../mozcloud-ingress/library | mozcloud-ingress-lib | 0.7.0 |
 | file://../../mozcloud-labels/library | mozcloud-labels-lib | 0.3.16 |
 
 ## Values
diff --git a/mozcloud/application/templates/gateway/backend.yaml b/mozcloud/application/templates/gateway/backend.yaml
index 392e5567..a3dcc441 100644
--- a/mozcloud/application/templates/gateway/backend.yaml
+++ b/mozcloud/application/templates/gateway/backend.yaml
@@ -93,6 +93,9 @@ backends:
       {{- if ($hostConfig.options).timeoutSec }}
       timeoutSec: {{ $hostConfig.options.timeoutSec | int }}
       {{- end }}
+      {{- if ($hostConfig.options).securityPolicy }}
+      securityPolicy: {{ $hostConfig.options.securityPolicy }}
+      {{- end }}
     healthCheck:
       {{- if (($hostConfig.options).healthCheck).host }}
       host: {{ $hostConfig.options.healthCheck.host }}
diff --git a/mozcloud/application/tests/basic-gateway-configuration_test.yaml b/mozcloud/application/tests/basic-gateway-configuration_test.yaml
index ea6971f9..3143a327 100644
--- a/mozcloud/application/tests/basic-gateway-configuration_test.yaml
+++ b/mozcloud/application/tests/basic-gateway-configuration_test.yaml
@@ -39,6 +39,8 @@ tests:
       - equal:
           path: spec.targetRef.name
           value: test-service
+      - notExists:
+          path: spec.default.securityPolicy
   - it: External gateway is configured correctly
     template: gateway/gateway.yaml
     documentSelector:
diff --git a/mozcloud/application/tests/security-policy-configuration_test.yaml b/mozcloud/application/tests/security-policy-configuration_test.yaml
new file mode 100644
index 00000000..482e9747
--- /dev/null
+++ b/mozcloud/application/tests/security-policy-configuration_test.yaml
@@ -0,0 +1,26 @@
+---
+suite: "mozcloud: Security policy configuration"
+release:
+  name: mozcloud-test
+  namespace: mozcloud-test-dev
+chart:
+  version: 1.0.0
+values:
+  - values/globals.yaml
+  - values/security-policy-configuration.yaml
+templates:
+  - gateway/backend.yaml
+  - gke/backend.yaml
+tests:
+  - it: Ensure no failures occur
+    asserts:
+      - notFailedTemplate: {}
+  - it: GCP backend policy includes securityPolicy
+    template: gke/backend.yaml
+    documentSelector:
+      path: $[?(@.kind == "GCPBackendPolicy")].metadata.name
+      value: test-service
+    asserts:
+      - equal:
+          path: spec.default.securityPolicy
+          value: my-app-cloud-armor-policy
diff --git a/mozcloud/application/tests/values/security-policy-configuration.yaml b/mozcloud/application/tests/values/security-policy-configuration.yaml
new file mode 100644
index 00000000..17f506fb
--- /dev/null
+++ b/mozcloud/application/tests/values/security-policy-configuration.yaml
@@ -0,0 +1,15 @@
+---
+workloads:
+  test-service:
+    component: web
+    containers:
+      app:
+        image:
+          repository: test-repo/test-image
+          tag: 1.0.0
+    hosts:
+      test-service:
+        domains:
+          - test-service.dev.test-domain.com
+        options:
+          securityPolicy: my-app-cloud-armor-policy
diff --git a/mozcloud/application/values.schema.json b/mozcloud/application/values.schema.json
index 11536d51..0437c538 100644
--- a/mozcloud/application/values.schema.json
+++ b/mozcloud/application/values.schema.json
@@ -701,6 +701,10 @@
                                 "type": "string"
                               }
                             }
+                          },
+                          "securityPolicy": {
+                            "type": "string",
+                            "description": "Cloud Armor security policy name to attach to the load balancer backend. For migration of existing applications only — new applications should use Fastly for WAF instead."
                           }
                         }
                       },
@@ -871,6 +875,10 @@
                           "type": "string"
                         }
                       }
+                    },
+                    "securityPolicy": {
+                      "type": "string",
+                      "description": "Cloud Armor security policy name to attach to the load balancer backend. For migration of existing applications only — new applications should use Fastly for WAF instead."
                     }
                   }
                 },
diff --git a/mozcloud/application/values.yaml b/mozcloud/application/values.yaml
index 89649f00..11e4edfb 100644
--- a/mozcloud/application/values.yaml
+++ b/mozcloud/application/values.yaml
@@ -1298,7 +1298,15 @@ workloads:
         #
         #  # Backend service timeout period in seconds.
         #  #timeoutSec: 30
+        #
+        #  # Cloud Armor security policy to attach to the load balancer backend.
+        #  # This should match the name of an existing Cloud Armor policy in GCP.
         #  #
+        #  # NOTE: This option exists only to support migration of existing
+        #  # applications that already use Cloud Armor. New applications should
+        #  # NOT use this — use Fastly for WAF instead.
+        #  #securityPolicy: my-app-policy
+        #
         #  # Custom config for backend health check
         #  #healthCheck:
         #  #  #path: /readiness/

From 3b6c6682e4b5180ed2dc92f6d3dbac34ecf1bf5b Mon Sep 17 00:00:00 2001
From: Graham Beckley <gbeckley@mozilla.com>
Date: Thu, 26 Mar 2026 16:36:08 -0400
Subject: [PATCH 4/6] PR review fixes

- alphabatize hosts.<host>.options values comments and schema
- remove securityPolicy schema entry from hosts.<host>.backends[].backendPolicy

Since this path doesn't include other options like timeoutSec, iap, and logSampleRate, don't keep securityPolicy around
---
 mozcloud/application/values.schema.json | 12 ++++--------
 mozcloud/application/values.yaml        |  8 ++++----
 2 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/mozcloud/application/values.schema.json b/mozcloud/application/values.schema.json
index 0437c538..79a6407c 100644
--- a/mozcloud/application/values.schema.json
+++ b/mozcloud/application/values.schema.json
@@ -701,10 +701,6 @@
                                 "type": "string"
                               }
                             }
-                          },
-                          "securityPolicy": {
-                            "type": "string",
-                            "description": "Cloud Armor security policy name to attach to the load balancer backend. For migration of existing applications only — new applications should use Fastly for WAF instead."
                           }
                         }
                       },
@@ -849,6 +845,10 @@
                       ],
                       "default": 10
                     },
+                    "securityPolicy": {
+                      "type": "string",
+                      "description": "Cloud Armor security policy name to attach to the load balancer backend. For migration of existing applications only — new applications should use Fastly for WAF instead."
+                    },
                     "timeoutSec": {
                       "type": "integer",
                       "minimum": 0,
@@ -875,10 +875,6 @@
                           "type": "string"
                         }
                       }
-                    },
-                    "securityPolicy": {
-                      "type": "string",
-                      "description": "Cloud Armor security policy name to attach to the load balancer backend. For migration of existing applications only — new applications should use Fastly for WAF instead."
                     }
                   }
                 },
diff --git a/mozcloud/application/values.yaml b/mozcloud/application/values.yaml
index 11e4edfb..e5f3fb19 100644
--- a/mozcloud/application/values.yaml
+++ b/mozcloud/application/values.yaml
@@ -1278,7 +1278,7 @@ workloads:
           type: certmap
 
         # Optionally configure the log sample rate for the load balancer, IAP
-        # details, or a custom backend timeout.
+        # details, a custom backend timeout, or a Cloud Armor security policy.
         #options:
         #  # Configures Identity-Aware Proxy for the service.
         #  #iap:
@@ -1296,9 +1296,6 @@ workloads:
         #  # configured as a float, integer, or string. The default is 10 (10%).
         #  #logSampleRate: 10
         #
-        #  # Backend service timeout period in seconds.
-        #  #timeoutSec: 30
-        #
         #  # Cloud Armor security policy to attach to the load balancer backend.
         #  # This should match the name of an existing Cloud Armor policy in GCP.
         #  #
@@ -1307,6 +1304,9 @@ workloads:
         #  # NOT use this — use Fastly for WAF instead.
         #  #securityPolicy: my-app-policy
         #
+        #  # Backend service timeout period in seconds.
+        #  #timeoutSec: 30
+        #
         #  # Custom config for backend health check
         #  #healthCheck:
         #  #  #path: /readiness/

From b6a3b98663a8a3ca07b044c1127ea75d32359cf6 Mon Sep 17 00:00:00 2001
From: Graham Beckley <gbeckley@mozilla.com>
Date: Mon, 30 Mar 2026 13:48:11 -0400
Subject: [PATCH 5/6] chore: Revert chart bumps

Now that we have a CI automation to handle chart bumps, remove them from this PR and let that automation do its thing
---
 mozcloud-gateway/application/Chart.yaml | 4 ++--
 mozcloud-gateway/application/README.md  | 6 +++---
 mozcloud-gateway/library/Chart.yaml     | 2 +-
 mozcloud-gateway/library/README.md      | 4 ++--
 mozcloud-ingress/application/Chart.yaml | 4 ++--
 mozcloud-ingress/application/README.md  | 6 +++---
 mozcloud-ingress/library/Chart.yaml     | 2 +-
 mozcloud-ingress/library/README.md      | 4 ++--
 mozcloud/application/Chart.yaml         | 8 ++++----
 mozcloud/application/README.md          | 8 ++++----
 10 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/mozcloud-gateway/application/Chart.yaml b/mozcloud-gateway/application/Chart.yaml
index d9e77c21..0d7aa2a9 100644
--- a/mozcloud-gateway/application/Chart.yaml
+++ b/mozcloud-gateway/application/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.0
+version: 0.5.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -26,5 +26,5 @@ appVersion: 0.4.2
 
 dependencies:
   - name: mozcloud-gateway-lib
-    version: 0.6.0
+    version: 0.5.0
     repository: file://../library
diff --git a/mozcloud-gateway/application/README.md b/mozcloud-gateway/application/README.md
index 979fdf10..674ef748 100644
--- a/mozcloud-gateway/application/README.md
+++ b/mozcloud-gateway/application/README.md
@@ -1,6 +1,6 @@
 # mozcloud-gateway
 
-![Version: 0.6.0](https://img.shields.io/badge/Version-0.6.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart that creates gateways and supporting Gateway API resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-gateway
-    version: ~0.6.0
+    version: ~0.5.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -34,7 +34,7 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://../library | mozcloud-gateway-lib | 0.6.0 |
+| file://../library | mozcloud-gateway-lib | 0.5.0 |
 
 ## Values
 
diff --git a/mozcloud-gateway/library/Chart.yaml b/mozcloud-gateway/library/Chart.yaml
index 19bf56f0..178ca5ac 100644
--- a/mozcloud-gateway/library/Chart.yaml
+++ b/mozcloud-gateway/library/Chart.yaml
@@ -16,7 +16,7 @@ type: library
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.0
+version: 0.5.0
 
 dependencies:
   - name: mozcloud-labels-lib
diff --git a/mozcloud-gateway/library/README.md b/mozcloud-gateway/library/README.md
index 125b71b9..d83e5d9d 100644
--- a/mozcloud-gateway/library/README.md
+++ b/mozcloud-gateway/library/README.md
@@ -1,6 +1,6 @@
 # mozcloud-gateway-lib
 
-![Version: 0.6.0](https://img.shields.io/badge/Version-0.6.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
+![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
 
 A library chart that creates gateways and supporting Gateway API resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-gateway-lib
-    version: ~0.6.0
+    version: ~0.5.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
diff --git a/mozcloud-ingress/application/Chart.yaml b/mozcloud-ingress/application/Chart.yaml
index 12952abc..b96352f6 100644
--- a/mozcloud-ingress/application/Chart.yaml
+++ b/mozcloud-ingress/application/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.8.0
+version: 0.7.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -25,5 +25,5 @@ appVersion: 0.4.2
 
 dependencies:
   - name: mozcloud-ingress-lib
-    version: 0.8.0
+    version: 0.7.1
     repository: file://../library
diff --git a/mozcloud-ingress/application/README.md b/mozcloud-ingress/application/README.md
index dd67d0b0..3ddc6ac9 100644
--- a/mozcloud-ingress/application/README.md
+++ b/mozcloud-ingress/application/README.md
@@ -1,6 +1,6 @@
 # mozcloud-ingress
 
-![Version: 0.8.0](https://img.shields.io/badge/Version-0.8.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.7.1](https://img.shields.io/badge/Version-0.7.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart that creates ingress and supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-ingress
-    version: ~0.8.0
+    version: ~0.7.1
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -34,7 +34,7 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://../library | mozcloud-ingress-lib | 0.8.0 |
+| file://../library | mozcloud-ingress-lib | 0.7.1 |
 
 ## Values
 
diff --git a/mozcloud-ingress/library/Chart.yaml b/mozcloud-ingress/library/Chart.yaml
index bfb0f377..a0130c98 100644
--- a/mozcloud-ingress/library/Chart.yaml
+++ b/mozcloud-ingress/library/Chart.yaml
@@ -15,7 +15,7 @@ type: library
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.8.0
+version: 0.7.1
 
 dependencies:
   - name: mozcloud-labels-lib
diff --git a/mozcloud-ingress/library/README.md b/mozcloud-ingress/library/README.md
index be9c1b1a..718ce9cc 100644
--- a/mozcloud-ingress/library/README.md
+++ b/mozcloud-ingress/library/README.md
@@ -1,6 +1,6 @@
 # mozcloud-ingress-lib
 
-![Version: 0.8.0](https://img.shields.io/badge/Version-0.8.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
+![Version: 0.7.1](https://img.shields.io/badge/Version-0.7.1-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
 
 A library chart that creates ingress and supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-ingress-lib
-    version: ~0.8.0
+    version: ~0.7.1
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
diff --git a/mozcloud/application/Chart.yaml b/mozcloud/application/Chart.yaml
index 69e45be6..a3938975 100644
--- a/mozcloud/application/Chart.yaml
+++ b/mozcloud/application/Chart.yaml
@@ -1,15 +1,15 @@
 apiVersion: v2
 name: mozcloud
-description: Opinionated application chart used to deploy MozCloud Kubernetes
+description: Opinionated application chart used to deploy MozCloud Kubernetes 
   resources supporting resources
-version: 0.16.0
+version: 0.15.3
 type: application
 dependencies:
   - name: mozcloud-gateway-lib
-    version: 0.6.0
+    version: 0.5.0
     repository: file://../../mozcloud-gateway/library
   - name: mozcloud-ingress-lib
-    version: 0.8.0
+    version: 0.7.1
     repository: file://../../mozcloud-ingress/library
   - name: mozcloud-labels-lib
     version: 0.3.16
diff --git a/mozcloud/application/README.md b/mozcloud/application/README.md
index afac95da..a0db6727 100644
--- a/mozcloud/application/README.md
+++ b/mozcloud/application/README.md
@@ -1,6 +1,6 @@
 # mozcloud
 
-![Version: 0.16.0](https://img.shields.io/badge/Version-0.16.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.15.3](https://img.shields.io/badge/Version-0.15.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Opinionated application chart used to deploy MozCloud Kubernetes resources supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud
-    version: ~0.16.0
+    version: ~0.15.3
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -34,8 +34,8 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://../../mozcloud-gateway/library | mozcloud-gateway-lib | 0.6.0 |
-| file://../../mozcloud-ingress/library | mozcloud-ingress-lib | 0.8.0 |
+| file://../../mozcloud-gateway/library | mozcloud-gateway-lib | 0.5.0 |
+| file://../../mozcloud-ingress/library | mozcloud-ingress-lib | 0.7.1 |
 | file://../../mozcloud-labels/library | mozcloud-labels-lib | 0.3.16 |
 
 ## Values

From 3afcbd1bcd92eb34851aef463ee8caafc6bf114a Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 18:01:36 +0000
Subject: [PATCH 6/6] chore: bump chart versions and update docs [skip ci]

- mozcloud: 0.15.3 -> 0.16.0
- mozcloud-gateway: 0.5.0 -> 0.6.0
- mozcloud-gateway-lib: 0.5.0 -> 0.6.0
- mozcloud-ingress: 0.7.1 -> 0.8.0
- mozcloud-ingress-lib: 0.7.1 -> 0.8.0
---
 mozcloud-gateway/application/Chart.yaml | 6 +++---
 mozcloud-gateway/application/README.md  | 6 +++---
 mozcloud-gateway/library/Chart.yaml     | 4 ++--
 mozcloud-gateway/library/README.md      | 4 ++--
 mozcloud-ingress/application/Chart.yaml | 4 ++--
 mozcloud-ingress/application/README.md  | 6 +++---
 mozcloud-ingress/library/Chart.yaml     | 2 +-
 mozcloud-ingress/library/README.md      | 4 ++--
 mozcloud/application/Chart.yaml         | 6 +++---
 mozcloud/application/README.md          | 8 ++++----
 10 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/mozcloud-gateway/application/Chart.yaml b/mozcloud-gateway/application/Chart.yaml
index 0d7aa2a9..cf82d3fa 100644
--- a/mozcloud-gateway/application/Chart.yaml
+++ b/mozcloud-gateway/application/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: mozcloud-gateway
-description: A Helm chart that creates gateways and supporting Gateway API
+description: A Helm chart that creates gateways and supporting Gateway API 
   resources
 
 # A chart can be either an 'application' or a 'library' chart.
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.0
+version: 0.6.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -26,5 +26,5 @@ appVersion: 0.4.2
 
 dependencies:
   - name: mozcloud-gateway-lib
-    version: 0.5.0
+    version: 0.6.0
     repository: file://../library
diff --git a/mozcloud-gateway/application/README.md b/mozcloud-gateway/application/README.md
index 674ef748..979fdf10 100644
--- a/mozcloud-gateway/application/README.md
+++ b/mozcloud-gateway/application/README.md
@@ -1,6 +1,6 @@
 # mozcloud-gateway
 
-![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.6.0](https://img.shields.io/badge/Version-0.6.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart that creates gateways and supporting Gateway API resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-gateway
-    version: ~0.5.0
+    version: ~0.6.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -34,7 +34,7 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://../library | mozcloud-gateway-lib | 0.5.0 |
+| file://../library | mozcloud-gateway-lib | 0.6.0 |
 
 ## Values
 
diff --git a/mozcloud-gateway/library/Chart.yaml b/mozcloud-gateway/library/Chart.yaml
index 178ca5ac..ea221640 100644
--- a/mozcloud-gateway/library/Chart.yaml
+++ b/mozcloud-gateway/library/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: mozcloud-gateway-lib
-description: A library chart that creates gateways and supporting Gateway API
+description: A library chart that creates gateways and supporting Gateway API 
   resources
 
 # A chart can be either an 'application' or a 'library' chart.
@@ -16,7 +16,7 @@ type: library
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.0
+version: 0.6.0
 
 dependencies:
   - name: mozcloud-labels-lib
diff --git a/mozcloud-gateway/library/README.md b/mozcloud-gateway/library/README.md
index d83e5d9d..125b71b9 100644
--- a/mozcloud-gateway/library/README.md
+++ b/mozcloud-gateway/library/README.md
@@ -1,6 +1,6 @@
 # mozcloud-gateway-lib
 
-![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
+![Version: 0.6.0](https://img.shields.io/badge/Version-0.6.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
 
 A library chart that creates gateways and supporting Gateway API resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-gateway-lib
-    version: ~0.5.0
+    version: ~0.6.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
diff --git a/mozcloud-ingress/application/Chart.yaml b/mozcloud-ingress/application/Chart.yaml
index b96352f6..12952abc 100644
--- a/mozcloud-ingress/application/Chart.yaml
+++ b/mozcloud-ingress/application/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.7.1
+version: 0.8.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -25,5 +25,5 @@ appVersion: 0.4.2
 
 dependencies:
   - name: mozcloud-ingress-lib
-    version: 0.7.1
+    version: 0.8.0
     repository: file://../library
diff --git a/mozcloud-ingress/application/README.md b/mozcloud-ingress/application/README.md
index 3ddc6ac9..dd67d0b0 100644
--- a/mozcloud-ingress/application/README.md
+++ b/mozcloud-ingress/application/README.md
@@ -1,6 +1,6 @@
 # mozcloud-ingress
 
-![Version: 0.7.1](https://img.shields.io/badge/Version-0.7.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.8.0](https://img.shields.io/badge/Version-0.8.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart that creates ingress and supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-ingress
-    version: ~0.7.1
+    version: ~0.8.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -34,7 +34,7 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://../library | mozcloud-ingress-lib | 0.7.1 |
+| file://../library | mozcloud-ingress-lib | 0.8.0 |
 
 ## Values
 
diff --git a/mozcloud-ingress/library/Chart.yaml b/mozcloud-ingress/library/Chart.yaml
index a0130c98..bfb0f377 100644
--- a/mozcloud-ingress/library/Chart.yaml
+++ b/mozcloud-ingress/library/Chart.yaml
@@ -15,7 +15,7 @@ type: library
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.7.1
+version: 0.8.0
 
 dependencies:
   - name: mozcloud-labels-lib
diff --git a/mozcloud-ingress/library/README.md b/mozcloud-ingress/library/README.md
index 718ce9cc..be9c1b1a 100644
--- a/mozcloud-ingress/library/README.md
+++ b/mozcloud-ingress/library/README.md
@@ -1,6 +1,6 @@
 # mozcloud-ingress-lib
 
-![Version: 0.7.1](https://img.shields.io/badge/Version-0.7.1-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
+![Version: 0.8.0](https://img.shields.io/badge/Version-0.8.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
 
 A library chart that creates ingress and supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud-ingress-lib
-    version: ~0.7.1
+    version: ~0.8.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
diff --git a/mozcloud/application/Chart.yaml b/mozcloud/application/Chart.yaml
index a3938975..68eac225 100644
--- a/mozcloud/application/Chart.yaml
+++ b/mozcloud/application/Chart.yaml
@@ -2,14 +2,14 @@ apiVersion: v2
 name: mozcloud
 description: Opinionated application chart used to deploy MozCloud Kubernetes 
   resources supporting resources
-version: 0.15.3
+version: 0.16.0
 type: application
 dependencies:
   - name: mozcloud-gateway-lib
-    version: 0.5.0
+    version: 0.6.0
     repository: file://../../mozcloud-gateway/library
   - name: mozcloud-ingress-lib
-    version: 0.7.1
+    version: 0.8.0
     repository: file://../../mozcloud-ingress/library
   - name: mozcloud-labels-lib
     version: 0.3.16
diff --git a/mozcloud/application/README.md b/mozcloud/application/README.md
index a0db6727..afac95da 100644
--- a/mozcloud/application/README.md
+++ b/mozcloud/application/README.md
@@ -1,6 +1,6 @@
 # mozcloud
 
-![Version: 0.15.3](https://img.shields.io/badge/Version-0.15.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.16.0](https://img.shields.io/badge/Version-0.16.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Opinionated application chart used to deploy MozCloud Kubernetes resources supporting resources
 
@@ -19,7 +19,7 @@ version: 0.1.0
 type: application
 dependencies:
   - name: mozcloud
-    version: ~0.15.3
+    version: ~0.16.0
     repository: oci://us-west1-docker.pkg.dev/moz-fx-platform-artifacts/mozcloud-charts
 ```
 
@@ -34,8 +34,8 @@ Next, update your tenant's values. Shared charts are meant to be self-documented
 
 | Repository | Name | Version |
 |------------|------|---------|
-| file://../../mozcloud-gateway/library | mozcloud-gateway-lib | 0.5.0 |
-| file://../../mozcloud-ingress/library | mozcloud-ingress-lib | 0.7.1 |
+| file://../../mozcloud-gateway/library | mozcloud-gateway-lib | 0.6.0 |
+| file://../../mozcloud-ingress/library | mozcloud-ingress-lib | 0.8.0 |
 | file://../../mozcloud-labels/library | mozcloud-labels-lib | 0.3.16 |
 
 ## Values