Repository: argoproj/argo-cd
Pull request #4685 (2020-10-27 22:02:05)

fix(ui): stack overflow crash of resource tree view for large applications
Checklist:

* [x] Either (a) I've created an [enhancement proposal](https://github.com/argoproj/argo-cd/issues/new/choose) and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
* [x] The title of the PR states what changed and the related issues number (used for the release note).
* [ ] I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
* [ ] Does this PR require documentation updates?
* [ ] I've updated documentation as required by this PR.
* [x] Optional. My organization is added to USERS.md.
* [x] I've signed the CLA and my build is green ([troubleshooting builds](https://argoproj.github.io/argo-cd/developer-guide/ci/)). 


codecov-io: # [Codecov](https://codecov.io/gh/argoproj/argo-cd/pull/4685?src=pr&el=h1) Report
> Merging [#4685](https://codecov.io/gh/argoproj/argo-cd/pull/4685?src=pr&el=desc) into [master](https://codecov.io/gh/argoproj/argo-cd/commit/1cbada9d86495ef7294c5a80bae0e14aa40695db?el=desc) will **increase** coverage by `0.00%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/argoproj/argo-cd/pull/4685/graphs/tree.svg?width=650&height=150&src=pr&token=kf5kwuegwE)](https://codecov.io/gh/argoproj/argo-cd/pull/4685?src=pr&el=tree)

```diff
@@           Coverage Diff            @@
##           master    #4685    +/-   ##
========================================
  Coverage   41.26%   41.27%            
========================================
  Files         124      126     +2     
  Lines       16991    17154   +163     
========================================
+ Hits         7012     7080    +68     
- Misses       8967     9063    +96     
+ Partials     1012     1011     -1     
```


| [Impacted Files](https://codecov.io/gh/argoproj/argo-cd/pull/4685?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [controller/appcontroller.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-Y29udHJvbGxlci9hcHBjb250cm9sbGVyLmdv) | `50.56% <0.00%> (-2.09%)` | :arrow_down: |
| [server/project/project.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-c2VydmVyL3Byb2plY3QvcHJvamVjdC5nbw==) | `55.83% <0.00%> (-1.31%)` | :arrow_down: |
| [util/argo/argo.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-dXRpbC9hcmdvL2FyZ28uZ28=) | `64.68% <0.00%> (-0.34%)` | :arrow_down: |
| [test/testdata.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-dGVzdC90ZXN0ZGF0YS5nbw==) | `0.00% <0.00%> (ø)` | |
| [util/helm/cmd.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-dXRpbC9oZWxtL2NtZC5nbw==) | `39.13% <0.00%> (ø)` | |
| [util/exec/exec.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-dXRpbC9leGVjL2V4ZWMuZ28=) | `85.71% <0.00%> (ø)` | |
| [util/cache/redis.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-dXRpbC9jYWNoZS9yZWRpcy5nbw==) | `45.94% <0.00%> (ø)` | |
| [util/swagger/swagger.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-dXRpbC9zd2FnZ2VyL3N3YWdnZXIuZ28=) | `100.00% <0.00%> (ø)` | |
| [controller/cache/cache.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-Y29udHJvbGxlci9jYWNoZS9jYWNoZS5nbw==) | `11.24% <0.00%> (ø)` | |
| [server/account/account.go](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree#diff-c2VydmVyL2FjY291bnQvYWNjb3VudC5nbw==) | `69.16% <0.00%> (ø)` | |
| ... and [13 more](https://codecov.io/gh/argoproj/argo-cd/pull/4685/diff?src=pr&el=tree-more) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/argoproj/argo-cd/pull/4685?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/argoproj/argo-cd/pull/4685?src=pr&el=footer). Last update [1cbada9...03d7340](https://codecov.io/gh/argoproj/argo-cd/pull/4685?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/assets/swagger.json b/assets/swagger.json
index 209c362fa..b816d9813 100644
--- a/assets/swagger.json
+++ b/assets/swagger.json
@@ -124,7 +124,7 @@
           "AccountService"
         ],
         "summary": "CreateToken creates a token",
-        "operationId": "CreateTokenMixin10",
+        "operationId": "CreateToken",
         "parameters": [
           {
             "type": "string",
@@ -157,7 +157,7 @@
           "AccountService"
         ],
         "summary": "DeleteToken deletes a token",
-        "operationId": "DeleteTokenMixin10",
+        "operationId": "DeleteToken",
         "parameters": [
           {
             "type": "string",
@@ -188,7 +188,7 @@
           "ApplicationService"
         ],
         "summary": "List returns list of applications",
-        "operationId": "ListMixin9",
+        "operationId": "List",
         "parameters": [
           {
             "type": "string",
@@ -239,7 +239,7 @@
           "ApplicationService"
         ],
         "summary": "Create creates an application",
-        "operationId": "CreateMixin9",
+        "operationId": "Create",
         "parameters": [
           {
             "name": "body",
@@ -266,7 +266,7 @@
           "ApplicationService"
         ],
         "summary": "Update updates an application",
-        "operationId": "UpdateMixin9",
+        "operationId": "Update",
         "parameters": [
           {
             "type": "string",
@@ -400,7 +400,7 @@
           "ApplicationService"
         ],
         "summary": "Get returns an application by name",
-        "operationId": "GetMixin9",
+        "operationId": "Get",
         "parameters": [
           {
             "type": "string",
@@ -452,7 +452,7 @@
           "ApplicationService"
         ],
         "summary": "Delete deletes an application",
-        "operationId": "DeleteMixin9",
+        "operationId": "Delete",
         "parameters": [
           {
             "type": "string",
@@ -1162,7 +1162,7 @@
           "ClusterService"
         ],
         "summary": "List returns list of clusters",
-        "operationId": "List",
+        "operationId": "ListMixin3",
         "parameters": [
           {
             "type": "string",
@@ -1189,7 +1189,7 @@
           "ClusterService"
         ],
         "summary": "Create creates a cluster",
-        "operationId": "Create",
+        "operationId": "CreateMixin3",
         "parameters": [
           {
             "name": "body",
@@ -1216,7 +1216,7 @@
           "ClusterService"
         ],
         "summary": "Update updates a cluster",
-        "operationId": "Update",
+        "operationId": "UpdateMixin3",
         "parameters": [
           {
             "type": "string",
@@ -1250,7 +1250,7 @@
           "ClusterService"
         ],
         "summary": "Get returns a cluster by server address",
-        "operationId": "GetMixin2",
+        "operationId": "GetMixin3",
         "parameters": [
           {
             "type": "string",
@@ -1278,7 +1278,7 @@
           "ClusterService"
         ],
         "summary": "Delete deletes a cluster",
-        "operationId": "Delete",
+        "operationId": "DeleteMixin3",
         "parameters": [
           {
             "type": "string",
@@ -1358,7 +1358,7 @@
           "GPGKeyService"
         ],
         "summary": "List all available repository certificates",
-        "operationId": "ListMixin7",
+        "operationId": "ListMixin4",
         "parameters": [
           {
             "type": "string",
@@ -1381,7 +1381,7 @@
           "GPGKeyService"
         ],
         "summary": "Create one or more GPG public keys in the server's configuration",
-        "operationId": "CreateMixin7",
+        "operationId": "CreateMixin4",
         "parameters": [
           {
             "description": "Raw key data of the GPG key(s) to create",
@@ -1407,7 +1407,7 @@
           "GPGKeyService"
         ],
         "summary": "Delete specified GPG public key from the server's configuration",
-        "operationId": "DeleteMixin7",
+        "operationId": "DeleteMixin4",
         "parameters": [
           {
             "type": "string",
@@ -1432,7 +1432,7 @@
           "GPGKeyService"
         ],
         "summary": "Get information about specified GPG public key from the server",
-        "operationId": "GetMixin7",
+        "operationId": "GetMixin4",
         "parameters": [
           {
             "type": "string",
@@ -1458,7 +1458,7 @@
           "ProjectService"
         ],
         "summary": "List returns list of projects",
-        "operationId": "ListMixin6",
+        "operationId": "ListMixin5",
         "parameters": [
           {
             "type": "string",
@@ -1480,7 +1480,7 @@
           "ProjectService"
         ],
         "summary": "Create a new project",
-        "operationId": "CreateMixin6",
+        "operationId": "CreateMixin5",
         "parameters": [
           {
             "name": "body",
@@ -1507,7 +1507,7 @@
           "ProjectService"
         ],
         "summary": "Get returns a project by name",
-        "operationId": "GetMixin6",
+        "operationId": "GetMixin5",
         "parameters": [
           {
             "type": "string",
@@ -1530,7 +1530,7 @@
           "ProjectService"
         ],
         "summary": "Delete deletes a project",
-        "operationId": "DeleteMixin6",
+        "operationId": "DeleteMixin5",
         "parameters": [
           {
             "type": "string",
@@ -1630,7 +1630,7 @@
           "ProjectService"
         ],
         "summary": "Update updates a project",
-        "operationId": "UpdateMixin6",
+        "operationId": "UpdateMixin5",
         "parameters": [
           {
             "type": "string",
@@ -1664,7 +1664,7 @@
           "ProjectService"
         ],
         "summary": "Create a new project token",
-        "operationId": "CreateToken",
+        "operationId": "CreateTokenMixin5",
         "parameters": [
           {
             "type": "string",
@@ -1703,7 +1703,7 @@
           "ProjectService"
         ],
         "summary": "Delete a new project token",
-        "operationId": "DeleteToken",
+        "operationId": "DeleteTokenMixin5",
         "parameters": [
           {
             "type": "string",
@@ -1948,7 +1948,7 @@
           "RepositoryService"
         ],
         "summary": "Get returns a repository or its credentials",
-        "operationId": "GetMixin3",
+        "operationId": "GetMixin7",
         "parameters": [
           {
             "type": "string",
@@ -2144,7 +2144,7 @@
           "SessionService"
         ],
         "summary": "Create a new JWT for authentication and set a cookie if using HTTP",
-        "operationId": "CreateMixin11",
+        "operationId": "CreateMixin8",
         "parameters": [
           {
             "name": "body",
@@ -2169,7 +2169,7 @@
           "SessionService"
         ],
         "summary": "Delete an existing JWT cookie if using HTTP",
-        "operationId": "DeleteMixin11",
+        "operationId": "DeleteMixin8",
         "responses": {
           "200": {
             "description": "A successful response.",
@@ -2203,7 +2203,7 @@
           "SettingsService"
         ],
         "summary": "Get returns Argo CD settings",
-        "operationId": "Get",
+        "operationId": "GetMixin10",
         "responses": {
           "200": {
             "description": "A successful response.",
@@ -4682,6 +4682,11 @@
           "format": "boolean",
           "title": "Whether git-lfs support should be enabled for this repo"
         },
+        "enableOCI": {
+          "type": "boolean",
+          "format": "boolean",
+          "title": "Whether helm-oci support should be enabled for this repo"
+        },
         "inheritedCreds": {
           "type": "boolean",
           "format": "boolean",
diff --git a/cmd/argocd-util/commands/project_allowlist.go b/cmd/argocd-util/commands/project_allowlist.go
new file mode 100644
index 000000000..8f6a103f6
--- /dev/null
+++ b/cmd/argocd-util/commands/project_allowlist.go
@@ -0,0 +1,144 @@
+package commands
+
+import (
+	"bufio"
+	"io"
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/ghodss/yaml"
+	"github.com/spf13/cobra"
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/discovery"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/argoproj/argo-cd/util/errors"
+
+	"github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
+	"github.com/argoproj/argo-cd/util/cli"
+
+	// load the gcp plugin (required to authenticate against GKE clusters).
+	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
+	// load the oidc plugin (required to authenticate with OpenID Connect).
+	_ "k8s.io/client-go/plugin/pkg/client/auth/oidc"
+	// load the azure plugin (required to authenticate with AKS clusters).
+	_ "k8s.io/client-go/plugin/pkg/client/auth/azure"
+)
+
+// NewProjectAllowListGenCommand generates a project from clusterRole
+func NewProjectAllowListGenCommand() *cobra.Command {
+	var (
+		clientConfig clientcmd.ClientConfig
+		out          string
+	)
+	var command = &cobra.Command{
+		Use:   "generate-allow-list CLUSTERROLE_PATH PROJ_NAME",
+		Short: "Generates project allow list from the specified clusterRole file",
+		Run: func(c *cobra.Command, args []string) {
+			if len(args) != 2 {
+				c.HelpFunc()(c, args)
+				os.Exit(1)
+			}
+			clusterRoleFileName := args[0]
+			projName := args[1]
+
+			var writer io.Writer
+			if out == "-" {
+				writer = os.Stdout
+			} else {
+				f, err := os.Create(out)
+				errors.CheckError(err)
+				bw := bufio.NewWriter(f)
+				writer = bw
+				defer func() {
+					err = bw.Flush()
+					errors.CheckError(err)
+					err = f.Close()
+					errors.CheckError(err)
+				}()
+			}
+
+			globalProj := generateProjectAllowList(clientConfig, clusterRoleFileName, projName)
+
+			yamlBytes, err := yaml.Marshal(globalProj)
+			errors.CheckError(err)
+
+			_, err = writer.Write(yamlBytes)
+			errors.CheckError(err)
+		},
+	}
+	clientConfig = cli.AddKubectlFlagsToCmd(command)
+	command.Flags().StringVarP(&out, "out", "o", "-", "Output to the specified file instead of stdout")
+
+	return command
+}
+
+func generateProjectAllowList(clientConfig clientcmd.ClientConfig, clusterRoleFileName string, projName string) v1alpha1.AppProject {
+	yamlBytes, err := ioutil.ReadFile(clusterRoleFileName)
+	errors.CheckError(err)
+	var obj unstructured.Unstructured
+	err = yaml.Unmarshal(yamlBytes, &obj)
+	errors.CheckError(err)
+
+	clusterRole := &rbacv1.ClusterRole{}
+	err = scheme.Scheme.Convert(&obj, clusterRole, nil)
+	errors.CheckError(err)
+
+	config, err := clientConfig.ClientConfig()
+	errors.CheckError(err)
+	disco, err := discovery.NewDiscoveryClientForConfig(config)
+	errors.CheckError(err)
+	serverResources, err := disco.ServerPreferredResources()
+	errors.CheckError(err)
+
+	resourceList := make([]metav1.GroupKind, 0)
+	for _, rule := range clusterRole.Rules {
+		if len(rule.APIGroups) <= 0 {
+			continue
+		}
+
+		canCreate := false
+		for _, verb := range rule.Verbs {
+			if strings.EqualFold(verb, "Create") {
+				canCreate = true
+				break
+			}
+		}
+
+		if !canCreate {
+			continue
+		}
+
+		ruleApiGroup := rule.APIGroups[0]
+		for _, ruleResource := range rule.Resources {
+			for _, apiResourcesList := range serverResources {
+				gv, err := schema.ParseGroupVersion(apiResourcesList.GroupVersion)
+				if err != nil {
+					gv = schema.GroupVersion{}
+				}
+				if ruleApiGroup == gv.Group {
+					for _, apiResource := range apiResourcesList.APIResources {
+						if apiResource.Name == ruleResource {
+							resourceList = append(resourceList, metav1.GroupKind{Group: ruleApiGroup, Kind: apiResource.Kind})
+						}
+					}
+				}
+			}
+		}
+	}
+	globalProj := v1alpha1.AppProject{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "AppProject",
+			APIVersion: "argoproj.io/v1alpha1",
+		},
+		ObjectMeta: metav1.ObjectMeta{Name: projName},
+		Spec:       v1alpha1.AppProjectSpec{},
+	}
+	globalProj.Spec.NamespaceResourceWhitelist = resourceList
+	return globalProj
+}
diff --git a/cmd/argocd-util/commands/projects.go b/cmd/argocd-util/commands/projects.go
index d5276bc3a..d8f7e61a0 100644
--- a/cmd/argocd-util/commands/projects.go
+++ b/cmd/argocd-util/commands/projects.go
@@ -28,6 +28,7 @@ func NewProjectsCommand() *cobra.Command {
 	}
 
 	command.AddCommand(NewUpdatePolicyRuleCommand())
+	command.AddCommand(NewProjectAllowListGenCommand())
 	return command
 }
 
diff --git a/cmd/argocd/commands/repo.go b/cmd/argocd/commands/repo.go
index 035416e82..cb151f5d9 100644
--- a/cmd/argocd/commands/repo.go
+++ b/cmd/argocd/commands/repo.go
@@ -49,6 +49,7 @@ func NewRepoAddCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 		tlsClientCertPath              string
 		tlsClientCertKeyPath           string
 		enableLfs                      bool
+		enableOci                      bool
 	)
 
 	// For better readability and easier formatting
@@ -69,6 +70,9 @@ func NewRepoAddCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 
   # Add a private Helm repository named 'stable' via HTTPS
   argocd repo add https://kubernetes-charts.storage.googleapis.com --type helm --name stable --username test --password test
+
+  # Add a private Helm OCI-based repository named 'stable' via HTTPS
+  argocd repo add helm-oci-registry.cn-zhangjiakou.cr.aliyuncs.com --type helm --name stable --enable-oci --username test --password test
 `
 
 	var command = &cobra.Command{
@@ -126,6 +130,7 @@ func NewRepoAddCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 			repo.InsecureIgnoreHostKey = insecureIgnoreHostKey
 			repo.Insecure = insecureSkipServerVerification
 			repo.EnableLFS = enableLfs
+			repo.EnableOCI = enableOci
 
 			if repo.Type == "helm" && repo.Name == "" {
 				errors.CheckError(fmt.Errorf("Must specify --name for repos of type 'helm'"))
@@ -157,6 +162,7 @@ func NewRepoAddCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 				TlsClientCertData: repo.TLSClientCertData,
 				TlsClientCertKey:  repo.TLSClientCertKey,
 				Insecure:          repo.IsInsecure(),
+				EnableOci:         repo.EnableOCI,
 			}
 			_, err := repoIf.ValidateAccess(context.Background(), &repoAccessReq)
 			errors.CheckError(err)
@@ -181,6 +187,7 @@ func NewRepoAddCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	command.Flags().BoolVar(&insecureIgnoreHostKey, "insecure-ignore-host-key", false, "disables SSH strict host key checking (deprecated, use --insecure-skip-server-verification instead)")
 	command.Flags().BoolVar(&insecureSkipServerVerification, "insecure-skip-server-verification", false, "disables server certificate and host key checks")
 	command.Flags().BoolVar(&enableLfs, "enable-lfs", false, "enable git-lfs (Large File Support) on this repository")
+	command.Flags().BoolVar(&enableOci, "enable-oci", false, "enable helm-oci (Helm OCI-Based Repository)")
 	command.Flags().BoolVar(&upsert, "upsert", false, "Override an existing repository with the same name even if the spec differs")
 	return command
 }
@@ -209,7 +216,7 @@ func NewRepoRemoveCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command
 // Print table of repo info
 func printRepoTable(repos appsv1.Repositories) {
 	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
-	_, _ = fmt.Fprintf(w, "TYPE\tNAME\tREPO\tINSECURE\tLFS\tCREDS\tSTATUS\tMESSAGE\n")
+	_, _ = fmt.Fprintf(w, "TYPE\tNAME\tREPO\tINSECURE\tOCI\tLFS\tCREDS\tSTATUS\tMESSAGE\n")
 	for _, r := range repos {
 		var hasCreds string
 		if !r.HasCredentials() {
@@ -221,7 +228,7 @@ func printRepoTable(repos appsv1.Repositories) {
 				hasCreds = "true"
 			}
 		}
-		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%v\t%v\t%s\t%s\t%s\n", r.Type, r.Name, r.Repo, r.IsInsecure(), r.EnableLFS, hasCreds, r.ConnectionState.Status, r.ConnectionState.Message)
+		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%v\t%v\t%v\t%s\t%s\t%s\n", r.Type, r.Name, r.Repo, r.IsInsecure(), r.EnableOCI, r.EnableLFS, hasCreds, r.ConnectionState.Status, r.ConnectionState.Message)
 	}
 	_ = w.Flush()
 }
diff --git a/docs/user-guide/commands/argocd_repo_add.md b/docs/user-guide/commands/argocd_repo_add.md
index a1a22798b..4632471a9 100644
--- a/docs/user-guide/commands/argocd_repo_add.md
+++ b/docs/user-guide/commands/argocd_repo_add.md
@@ -31,12 +31,16 @@ argocd repo add REPOURL [flags]
   # Add a private Helm repository named 'stable' via HTTPS
   argocd repo add https://kubernetes-charts.storage.googleapis.com --type helm --name stable --username test --password test
 
+  # Add a private Helm OCI-based repository named 'stable' via HTTPS
+  argocd repo add helm-oci-registry.cn-zhangjiakou.cr.aliyuncs.com --type helm --name stable --enable-oci --username test --password test
+
 ```
 
 ### Options
 
 ```
       --enable-lfs                          enable git-lfs (Large File Support) on this repository
+      --enable-oci                          enable helm-oci (Helm OCI-Based Repository)
   -h, --help                                help for add
       --insecure-ignore-host-key            disables SSH strict host key checking (deprecated, use --insecure-skip-server-verification instead)
       --insecure-skip-server-verification   disables server certificate and host key checks
diff --git a/pkg/apiclient/repository/repository.pb.go b/pkg/apiclient/repository/repository.pb.go
index 5a3d0d9a7..5e9ca4d3a 100644
--- a/pkg/apiclient/repository/repository.pb.go
+++ b/pkg/apiclient/repository/repository.pb.go
@@ -320,7 +320,9 @@ type RepoAccessQuery struct {
 	// The type of the repo
 	Type string `protobuf:"bytes,9,opt,name=type,proto3" json:"type,omitempty"`
 	// The name of the repo
-	Name                 string   `protobuf:"bytes,10,opt,name=name,proto3" json:"name,omitempty"`
+	Name string `protobuf:"bytes,10,opt,name=name,proto3" json:"name,omitempty"`
+	// Whether helm-oci support should be enabled for this repo
+	EnableOci            bool     `protobuf:"varint,11,opt,name=enableOci,proto3" json:"enableOci,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -422,6 +424,13 @@ func (m *RepoAccessQuery) GetName() string {
 	return ""
 }
 
+func (m *RepoAccessQuery) GetEnableOci() bool {
+	if m != nil {
+		return m.EnableOci
+	}
+	return false
+}
+
 type RepoResponse struct {
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
@@ -592,67 +601,68 @@ func init() {
 }
 
 var fileDescriptor_8d38260443475705 = []byte{
-	// 955 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x56, 0x4f, 0x6f, 0x1b, 0x45,
-	0x14, 0xd7, 0x26, 0xa9, 0x9b, 0x4c, 0x9a, 0xe0, 0x4e, 0x4b, 0x65, 0x5c, 0x37, 0x8d, 0xa6, 0xa5,
-	0x0a, 0x51, 0xd9, 0xc5, 0x06, 0x24, 0x54, 0x84, 0x50, 0xe2, 0xa0, 0x12, 0x11, 0x09, 0xd8, 0xaa,
-	0x48, 0x70, 0x41, 0xd3, 0xf5, 0x8b, 0xbd, 0x64, 0xbd, 0x33, 0xcc, 0x8c, 0x17, 0x59, 0x51, 0x2f,
-	0x9c, 0x0a, 0x37, 0x40, 0xdc, 0xb8, 0x54, 0xe2, 0xc0, 0x47, 0xe1, 0x88, 0xc4, 0x17, 0x40, 0x11,
-	0x1f, 0x04, 0xcd, 0xcc, 0xfe, 0x73, 0x6c, 0x6f, 0x5b, 0x91, 0xe6, 0xf6, 0xe6, 0xcd, 0x9b, 0xf7,
-	0xfb, 0xbd, 0xdf, 0xbc, 0x7d, 0x3b, 0x88, 0x48, 0x10, 0x09, 0x08, 0x4f, 0x00, 0x67, 0x32, 0x54,
-	0x4c, 0x8c, 0x4b, 0xa6, 0xcb, 0x05, 0x53, 0x0c, 0xa3, 0xc2, 0xd3, 0xbc, 0xda, 0x67, 0x7d, 0x66,
-	0xdc, 0x9e, 0xb6, 0x6c, 0x44, 0xb3, 0xd5, 0x67, 0xac, 0x1f, 0x81, 0x47, 0x79, 0xe8, 0xd1, 0x38,
-	0x66, 0x8a, 0xaa, 0x90, 0xc5, 0x32, 0xdd, 0x25, 0x47, 0xef, 0x49, 0x37, 0x64, 0x66, 0x37, 0x60,
-	0x02, 0xbc, 0xa4, 0xed, 0xf5, 0x21, 0x06, 0x41, 0x15, 0xf4, 0xd2, 0x98, 0xfd, 0x7e, 0xa8, 0x06,
-	0xa3, 0x47, 0x6e, 0xc0, 0x86, 0x1e, 0x15, 0x06, 0xe2, 0x1b, 0x63, 0xbc, 0x19, 0xf4, 0x3c, 0x7e,
-	0xd4, 0xd7, 0x87, 0xa5, 0x47, 0x39, 0x8f, 0xc2, 0xc0, 0x24, 0xf7, 0x92, 0x36, 0x8d, 0xf8, 0x80,
-	0x4e, 0xa7, 0xda, 0xad, 0x4a, 0x65, 0x4a, 0x79, 0x66, 0xc9, 0xe4, 0x43, 0xb4, 0xe6, 0x03, 0x67,
-	0x3b, 0x9c, 0xcb, 0xcf, 0x47, 0x20, 0xc6, 0x18, 0xa3, 0x25, 0x1d, 0xd4, 0x70, 0x36, 0x9d, 0xad,
-	0x15, 0xdf, 0xd8, 0xb8, 0x89, 0x96, 0x05, 0x24, 0xa1, 0x0c, 0x59, 0xdc, 0x58, 0x30, 0xfe, 0x7c,
-	0x4d, 0xda, 0xe8, 0xe2, 0x0e, 0xe7, 0xfb, 0xf1, 0x21, 0xd3, 0x47, 0xd5, 0x98, 0x43, 0x76, 0x54,
-	0xdb, 0xda, 0xc7, 0xa9, 0x1a, 0xa4, 0xc7, 0x8c, 0x4d, 0x8e, 0xd1, 0x95, 0x14, 0x73, 0x0f, 0x14,
-	0x0d, 0xa3, 0x14, 0xb9, 0x87, 0x6a, 0x92, 0x8d, 0x44, 0x60, 0x13, 0xac, 0x76, 0x0e, 0xdc, 0xa2,
-	0x3e, 0x37, 0xab, 0xcf, 0x18, 0x5f, 0x07, 0x3d, 0x97, 0x1f, 0xf5, 0x5d, 0x2d, 0x95, 0x5b, 0x92,
-	0xca, 0xcd, 0xa4, 0x72, 0x77, 0x0a, 0xe7, 0x03, 0x93, 0xd3, 0x4f, 0x73, 0x93, 0x0f, 0x50, 0x3d,
-	0x2b, 0xd8, 0x07, 0xc9, 0x59, 0x2c, 0x01, 0xbf, 0x81, 0x2e, 0x84, 0x0a, 0x86, 0xb2, 0xe1, 0x6c,
-	0x2e, 0x6e, 0xad, 0x76, 0xae, 0xb8, 0x25, 0x99, 0xd2, 0xe2, 0x7c, 0x1b, 0x41, 0xba, 0x68, 0x45,
-	0x1f, 0x9f, 0xaf, 0x15, 0x41, 0x97, 0x0e, 0x99, 0x06, 0x84, 0x43, 0x01, 0xd2, 0x16, 0xbe, 0xec,
-	0x4f, 0xf8, 0xc8, 0xd3, 0x05, 0xf4, 0x8a, 0x21, 0x11, 0x04, 0x20, 0xab, 0x75, 0x1f, 0x49, 0x10,
-	0x31, 0x1d, 0x42, 0xa6, 0x7b, 0xb6, 0xd6, 0x7b, 0x9c, 0x4a, 0xf9, 0x1d, 0x13, 0xbd, 0xc6, 0xa2,
-	0xdd, 0xcb, 0xd6, 0xf8, 0x36, 0x5a, 0x93, 0x72, 0xf0, 0x99, 0x08, 0x13, 0xaa, 0xe0, 0x13, 0x18,
-	0x37, 0x96, 0x4c, 0xc0, 0xa4, 0x53, 0x67, 0x08, 0x63, 0x09, 0xc1, 0x48, 0x40, 0xe3, 0x82, 0x61,
-	0x99, 0xaf, 0xf1, 0x5d, 0x74, 0x59, 0x45, 0xb2, 0x1b, 0x85, 0x10, 0xab, 0x2e, 0x08, 0xb5, 0x47,
-	0x15, 0x6d, 0xd4, 0x4c, 0x96, 0xe9, 0x0d, 0xbc, 0x8d, 0xea, 0x13, 0x4e, 0x0d, 0x79, 0xd1, 0x04,
-	0x4f, 0xf9, 0xf3, 0x26, 0x59, 0x99, 0x6c, 0x12, 0x53, 0x23, 0xb2, 0x3e, 0x6d, 0x93, 0x75, 0x74,
-	0x49, 0x4b, 0x94, 0xdd, 0x11, 0xf9, 0xdd, 0x41, 0x97, 0xb5, 0xa3, 0x2b, 0x80, 0x2a, 0xf0, 0xe1,
-	0xdb, 0x11, 0x48, 0x85, 0xbf, 0x2c, 0xa9, 0xb6, 0xda, 0xf9, 0xe8, 0x7f, 0x74, 0x8c, 0x9f, 0x5f,
-	0x79, 0x2a, 0xfe, 0x35, 0x54, 0x1b, 0x71, 0x09, 0x42, 0xa5, 0x57, 0x98, 0xae, 0x70, 0x0b, 0xad,
-	0x04, 0x02, 0x7a, 0xf2, 0xd3, 0x38, 0x1a, 0x1b, 0xe5, 0x97, 0xfd, 0xc2, 0x41, 0x62, 0xcb, 0xf2,
-	0x21, 0xef, 0x9d, 0x0b, 0xcb, 0xce, 0x8f, 0xeb, 0x16, 0xd0, 0x3a, 0x1f, 0x80, 0x48, 0xc2, 0x00,
-	0xf0, 0x0f, 0x0e, 0x5a, 0x3a, 0x08, 0xa5, 0xc2, 0xaf, 0x96, 0x5b, 0x39, 0x6f, 0xdc, 0xe6, 0xfe,
-	0x99, 0x50, 0xd0, 0x08, 0xe4, 0xe6, 0xf7, 0x7f, 0xff, 0xfb, 0xcb, 0xc2, 0x35, 0x7c, 0xd5, 0x4c,
-	0xbd, 0xa4, 0x5d, 0x8c, 0x98, 0x10, 0xe4, 0x93, 0x05, 0x07, 0x3f, 0x71, 0xd0, 0xe2, 0x7d, 0x98,
-	0x4b, 0xe5, 0x6c, 0xd4, 0x20, 0xb7, 0x0c, 0x8d, 0x1b, 0xf8, 0xfa, 0x2c, 0x1a, 0xde, 0xb1, 0x5e,
-	0x3d, 0xc6, 0x3f, 0x3b, 0xa8, 0xae, 0x49, 0xfb, 0xa5, 0xbd, 0x73, 0x90, 0xa8, 0x55, 0x25, 0x11,
-	0x1e, 0xa2, 0x65, 0x1d, 0xa5, 0x07, 0x12, 0x7e, 0xed, 0x34, 0x97, 0x7c, 0x2e, 0x37, 0x5b, 0xb3,
-	0xb6, 0xf2, 0xaf, 0x63, 0xcb, 0x40, 0x10, 0xbc, 0x59, 0x51, 0xbe, 0xfe, 0xa9, 0x48, 0xfc, 0x93,
-	0x83, 0xd6, 0xee, 0x83, 0x2a, 0x86, 0x2f, 0xbe, 0x39, 0x23, 0x73, 0x79, 0x30, 0x37, 0xc9, 0xfc,
-	0x80, 0x9c, 0xc0, 0xfb, 0x86, 0xc0, 0xbb, 0xe4, 0xad, 0xd9, 0x04, 0xec, 0xf0, 0x35, 0x79, 0x1e,
-	0xfa, 0x07, 0x86, 0x4a, 0xcf, 0x66, 0xb8, 0xe7, 0x6c, 0xe3, 0xc4, 0x50, 0xfa, 0x18, 0xa2, 0x61,
-	0x77, 0x40, 0x85, 0x9a, 0x7b, 0x27, 0x1b, 0x65, 0x77, 0x11, 0x9e, 0x93, 0x70, 0x0d, 0x89, 0x2d,
-	0x7c, 0xa7, 0x4a, 0x85, 0x01, 0x44, 0xc3, 0xc0, 0xc2, 0xfc, 0xea, 0xa0, 0x9a, 0x9d, 0x27, 0xf8,
-	0xc6, 0x69, 0xc4, 0x89, 0x39, 0x73, 0x56, 0x5d, 0xfa, 0xba, 0x21, 0xd8, 0x22, 0x33, 0x3b, 0xe1,
-	0x9e, 0xf9, 0xa2, 0xf5, 0x27, 0xf3, 0x9b, 0x83, 0xea, 0x19, 0x7e, 0x76, 0xf6, 0x9c, 0x18, 0x92,
-	0x67, 0x33, 0xc4, 0x4f, 0x1d, 0x54, 0xb3, 0x03, 0x6e, 0x9a, 0xd4, 0xc4, 0xe0, 0x3b, 0x2b, 0x52,
-	0x6d, 0x7b, 0xaf, 0xcd, 0x8a, 0xee, 0x36, 0x3c, 0x1e, 0x17, 0x12, 0xfe, 0xe1, 0xa0, 0x7a, 0xc6,
-	0x65, 0xbe, 0x84, 0x2f, 0x85, 0xad, 0xfb, 0x62, 0x6c, 0x31, 0x45, 0xb5, 0x3d, 0x88, 0x40, 0xc1,
-	0xbc, 0xb6, 0x6f, 0x9c, 0x76, 0xe7, 0x0d, 0x7f, 0xc7, 0x4e, 0xbd, 0xed, 0xaa, 0xa9, 0xa7, 0xd5,
-	0x18, 0xa0, 0xba, 0x85, 0x28, 0x89, 0xf1, 0xc2, 0x60, 0xb7, 0x9e, 0x03, 0x0c, 0x1f, 0xa3, 0xf5,
-	0x2f, 0x68, 0x14, 0x6a, 0x59, 0xed, 0xeb, 0x06, 0x5f, 0x9f, 0x9a, 0x1e, 0xc5, 0xab, 0xa7, 0x02,
-	0xad, 0x63, 0xd0, 0xee, 0x92, 0xdb, 0x55, 0xdf, 0x72, 0x92, 0x42, 0x59, 0x25, 0x77, 0x77, 0xff,
-	0x3c, 0xd9, 0x70, 0xfe, 0x3a, 0xd9, 0x70, 0xfe, 0x39, 0xd9, 0x70, 0xbe, 0x7a, 0xe7, 0x39, 0x5e,
-	0xda, 0x81, 0x79, 0x9b, 0x94, 0x9e, 0xc5, 0x8f, 0x6a, 0xe6, 0x5d, 0xfc, 0xf6, 0x7f, 0x01, 0x00,
-	0x00, 0xff, 0xff, 0xed, 0x96, 0x61, 0xeb, 0x30, 0x0c, 0x00, 0x00,
+	// 970 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x56, 0xcf, 0x6f, 0x1c, 0x35,
+	0x14, 0xd6, 0xa4, 0xe9, 0x36, 0x71, 0x9a, 0xb0, 0x75, 0x4b, 0xb5, 0x6c, 0xb7, 0x69, 0xe4, 0x96,
+	0x2a, 0x44, 0x65, 0x86, 0x5d, 0x40, 0x42, 0x45, 0x08, 0x25, 0x1b, 0x54, 0x22, 0x22, 0x15, 0xa6,
+	0x2a, 0x12, 0x5c, 0x90, 0x33, 0xfb, 0xb2, 0x6b, 0x32, 0x3b, 0x36, 0xb6, 0x77, 0xd1, 0x2a, 0xea,
+	0x85, 0x53, 0xe1, 0x06, 0x88, 0x1b, 0x17, 0x24, 0x0e, 0xfc, 0x17, 0x5c, 0x39, 0x22, 0xf1, 0x0f,
+	0xa0, 0x88, 0x3f, 0x04, 0xd9, 0x9e, 0x5f, 0x9b, 0xfd, 0xd1, 0x56, 0x84, 0xdc, 0xec, 0xcf, 0xf6,
+	0xfb, 0xbe, 0xf7, 0xf9, 0xcd, 0x1b, 0x23, 0xa2, 0x40, 0x0e, 0x41, 0x06, 0x12, 0x04, 0x57, 0x4c,
+	0x73, 0x39, 0x2a, 0x0d, 0x7d, 0x21, 0xb9, 0xe6, 0x18, 0x15, 0x48, 0xfd, 0x5a, 0x97, 0x77, 0xb9,
+	0x85, 0x03, 0x33, 0x72, 0x3b, 0xea, 0x8d, 0x2e, 0xe7, 0xdd, 0x18, 0x02, 0x2a, 0x58, 0x40, 0x93,
+	0x84, 0x6b, 0xaa, 0x19, 0x4f, 0x54, 0xba, 0x4a, 0x8e, 0xde, 0x51, 0x3e, 0xe3, 0x76, 0x35, 0xe2,
+	0x12, 0x82, 0x61, 0x33, 0xe8, 0x42, 0x02, 0x92, 0x6a, 0xe8, 0xa4, 0x7b, 0xf6, 0xba, 0x4c, 0xf7,
+	0x06, 0x07, 0x7e, 0xc4, 0xfb, 0x01, 0x95, 0x96, 0xe2, 0x4b, 0x3b, 0x78, 0x3d, 0xea, 0x04, 0xe2,
+	0xa8, 0x6b, 0x0e, 0xab, 0x80, 0x0a, 0x11, 0xb3, 0xc8, 0x06, 0x0f, 0x86, 0x4d, 0x1a, 0x8b, 0x1e,
+	0x9d, 0x0c, 0xb5, 0x33, 0x2f, 0x94, 0x4d, 0xe5, 0x99, 0x29, 0x93, 0xf7, 0xd1, 0x6a, 0x08, 0x82,
+	0x6f, 0x0b, 0xa1, 0x3e, 0x19, 0x80, 0x1c, 0x61, 0x8c, 0x16, 0xcd, 0xa6, 0x9a, 0xb7, 0xe1, 0x6d,
+	0x2e, 0x87, 0x76, 0x8c, 0xeb, 0x68, 0x49, 0xc2, 0x90, 0x29, 0xc6, 0x93, 0xda, 0x82, 0xc5, 0xf3,
+	0x39, 0x69, 0xa2, 0x4b, 0xdb, 0x42, 0xec, 0x25, 0x87, 0xdc, 0x1c, 0xd5, 0x23, 0x01, 0xd9, 0x51,
+	0x33, 0x36, 0x98, 0xa0, 0xba, 0x97, 0x1e, 0xb3, 0x63, 0x72, 0x8c, 0xae, 0xa6, 0x9c, 0xbb, 0xa0,
+	0x29, 0x8b, 0x53, 0xe6, 0x0e, 0xaa, 0x28, 0x3e, 0x90, 0x91, 0x0b, 0xb0, 0xd2, 0xda, 0xf7, 0x8b,
+	0xfc, 0xfc, 0x2c, 0x3f, 0x3b, 0xf8, 0x22, 0xea, 0xf8, 0xe2, 0xa8, 0xeb, 0x1b, 0xab, 0xfc, 0x92,
+	0x55, 0x7e, 0x66, 0x95, 0xbf, 0x5d, 0x80, 0x8f, 0x6c, 0xcc, 0x30, 0x8d, 0x4d, 0xde, 0x43, 0xd5,
+	0x2c, 0xe1, 0x10, 0x94, 0xe0, 0x89, 0x02, 0xfc, 0x1a, 0xba, 0xc8, 0x34, 0xf4, 0x55, 0xcd, 0xdb,
+	0xb8, 0xb0, 0xb9, 0xd2, 0xba, 0xea, 0x97, 0x6c, 0x4a, 0x93, 0x0b, 0xdd, 0x0e, 0xd2, 0x46, 0xcb,
+	0xe6, 0xf8, 0x6c, 0xaf, 0x08, 0xba, 0x7c, 0xc8, 0x0d, 0x21, 0x1c, 0x4a, 0x50, 0x2e, 0xf1, 0xa5,
+	0x70, 0x0c, 0x23, 0xbf, 0x2f, 0xa0, 0x97, 0xac, 0x88, 0x28, 0x02, 0x35, 0xdf, 0xf7, 0x81, 0x02,
+	0x99, 0xd0, 0x3e, 0x64, 0xbe, 0x67, 0x73, 0xb3, 0x26, 0xa8, 0x52, 0x5f, 0x73, 0xd9, 0xa9, 0x5d,
+	0x70, 0x6b, 0xd9, 0x1c, 0xdf, 0x41, 0xab, 0x4a, 0xf5, 0x3e, 0x96, 0x6c, 0x48, 0x35, 0x7c, 0x04,
+	0xa3, 0xda, 0xa2, 0xdd, 0x30, 0x0e, 0x9a, 0x08, 0x2c, 0x51, 0x10, 0x0d, 0x24, 0xd4, 0x2e, 0x5a,
+	0x95, 0xf9, 0x1c, 0xdf, 0x43, 0x57, 0x74, 0xac, 0xda, 0x31, 0x83, 0x44, 0xb7, 0x41, 0xea, 0x5d,
+	0xaa, 0x69, 0xad, 0x62, 0xa3, 0x4c, 0x2e, 0xe0, 0x2d, 0x54, 0x1d, 0x03, 0x0d, 0xe5, 0x25, 0xbb,
+	0x79, 0x02, 0xcf, 0x8b, 0x64, 0x79, 0xbc, 0x48, 0x6c, 0x8e, 0xc8, 0x61, 0x36, 0xbf, 0x06, 0x5a,
+	0x86, 0x84, 0x1e, 0xc4, 0xf0, 0x30, 0x62, 0xb5, 0x15, 0x2b, 0xaf, 0x00, 0xc8, 0x1a, 0xba, 0x6c,
+	0x0c, 0xcc, 0x6e, 0x90, 0xfc, 0xea, 0xa1, 0x2b, 0x06, 0x68, 0x4b, 0xa0, 0x1a, 0x42, 0xf8, 0x6a,
+	0x00, 0x4a, 0xe3, 0xcf, 0x4a, 0x9e, 0xae, 0xb4, 0x3e, 0xf8, 0x0f, 0xf5, 0x14, 0xe6, 0x05, 0x91,
+	0x5e, 0xcd, 0x75, 0x54, 0x19, 0x08, 0x05, 0x52, 0xa7, 0x17, 0x9c, 0xce, 0x8c, 0xec, 0x48, 0x42,
+	0x47, 0x3d, 0x4c, 0xe2, 0x91, 0xbd, 0x97, 0xa5, 0xb0, 0x00, 0x48, 0xe2, 0x54, 0x3e, 0x16, 0x9d,
+	0x73, 0x51, 0xd9, 0xfa, 0x6e, 0xcd, 0x11, 0x3a, 0xf0, 0x11, 0xc8, 0x21, 0x8b, 0x00, 0x7f, 0xeb,
+	0xa1, 0xc5, 0x7d, 0xa6, 0x34, 0x7e, 0xb9, 0x5c, 0xe8, 0x79, 0x59, 0xd7, 0xf7, 0xce, 0x44, 0x82,
+	0x61, 0x20, 0xb7, 0xbe, 0xf9, 0xeb, 0x9f, 0x1f, 0x17, 0xae, 0xe3, 0x6b, 0xb6, 0x27, 0x0e, 0x9b,
+	0x45, 0x03, 0x62, 0xa0, 0x9e, 0x2e, 0x78, 0xf8, 0xa9, 0x87, 0x2e, 0x3c, 0x80, 0x99, 0x52, 0xce,
+	0xc6, 0x0d, 0x72, 0xdb, 0xca, 0xb8, 0x89, 0x6f, 0x4c, 0x93, 0x11, 0x1c, 0x9b, 0xd9, 0x13, 0xfc,
+	0x83, 0x87, 0xaa, 0x46, 0x74, 0x58, 0x5a, 0x3b, 0x07, 0x8b, 0x1a, 0xf3, 0x2c, 0xc2, 0x7d, 0xb4,
+	0x64, 0x76, 0x99, 0x76, 0x85, 0x5f, 0x39, 0xad, 0x25, 0xef, 0xda, 0xf5, 0xc6, 0xb4, 0xa5, 0xfc,
+	0xeb, 0xd8, 0xb4, 0x14, 0x04, 0x6f, 0xcc, 0x49, 0xdf, 0xfc, 0x72, 0x14, 0xfe, 0xde, 0x43, 0xab,
+	0x0f, 0x40, 0x17, 0xad, 0x19, 0xdf, 0x9a, 0x12, 0xb9, 0xdc, 0xb6, 0xeb, 0x64, 0xf6, 0x86, 0x5c,
+	0xc0, 0xbb, 0x56, 0xc0, 0xdb, 0xe4, 0x8d, 0xe9, 0x02, 0x5c, 0x6b, 0xb6, 0x71, 0x1e, 0x87, 0xfb,
+	0x56, 0x4a, 0xc7, 0x45, 0xb8, 0xef, 0x6d, 0xe1, 0xa1, 0x95, 0xf4, 0x21, 0xc4, 0xfd, 0x76, 0x8f,
+	0x4a, 0x3d, 0xf3, 0x4e, 0xd6, 0xcb, 0x70, 0xb1, 0x3d, 0x17, 0xe1, 0x5b, 0x11, 0x9b, 0xf8, 0xee,
+	0x3c, 0x17, 0x7a, 0x10, 0xf7, 0x23, 0x47, 0xf3, 0x93, 0x87, 0x2a, 0xae, 0x9f, 0xe0, 0x9b, 0xa7,
+	0x19, 0xc7, 0xfa, 0xcc, 0x59, 0x55, 0xe9, 0xab, 0x56, 0x60, 0x83, 0x4c, 0xad, 0x84, 0xfb, 0xf6,
+	0x8b, 0x36, 0x9f, 0xcc, 0xcf, 0x1e, 0xaa, 0x66, 0xfc, 0xd9, 0xd9, 0x73, 0x52, 0x48, 0x9e, 0xad,
+	0x10, 0xff, 0xe2, 0xa1, 0x8a, 0x6b, 0x70, 0x93, 0xa2, 0xc6, 0x1a, 0xdf, 0x59, 0x89, 0x6a, 0xba,
+	0x7b, 0xad, 0xcf, 0xa9, 0x6e, 0xab, 0xe3, 0x49, 0x61, 0xe1, 0x6f, 0x1e, 0xaa, 0x66, 0x5a, 0x66,
+	0x5b, 0xf8, 0xbf, 0xa8, 0xf5, 0x5f, 0x4c, 0x2d, 0xa6, 0xa8, 0xb2, 0x0b, 0x31, 0x68, 0x98, 0x55,
+	0xf6, 0xb5, 0xd3, 0x70, 0x5e, 0xf0, 0x77, 0x5d, 0xd7, 0xdb, 0x9a, 0xd7, 0xf5, 0x8c, 0x1b, 0x3d,
+	0x54, 0x75, 0x14, 0x25, 0x33, 0x5e, 0x98, 0xec, 0xf6, 0x73, 0x90, 0xe1, 0x63, 0xb4, 0xf6, 0x29,
+	0x8d, 0x99, 0xb1, 0xd5, 0xbd, 0x7d, 0xf0, 0x8d, 0x89, 0xee, 0x51, 0xbc, 0x89, 0xe6, 0xb0, 0xb5,
+	0x2c, 0xdb, 0x3d, 0x72, 0x67, 0xde, 0xb7, 0x3c, 0x4c, 0xa9, 0x9c, 0x93, 0x3b, 0x3b, 0x7f, 0x9c,
+	0xac, 0x7b, 0x7f, 0x9e, 0xac, 0x7b, 0x7f, 0x9f, 0xac, 0x7b, 0x9f, 0xbf, 0xf5, 0x1c, 0xef, 0xf0,
+	0xc8, 0xbe, 0x5c, 0x4a, 0x8f, 0xe6, 0x83, 0x8a, 0x7d, 0x35, 0xbf, 0xf9, 0x6f, 0x00, 0x00, 0x00,
+	0xff, 0xff, 0x4d, 0x12, 0x9c, 0xe8, 0x4e, 0x0c, 0x00, 0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -1427,6 +1437,16 @@ func (m *RepoAccessQuery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if m.EnableOci {
+		i--
+		if m.EnableOci {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x58
+	}
 	if len(m.Name) > 0 {
 		i -= len(m.Name)
 		copy(dAtA[i:], m.Name)
@@ -1766,6 +1786,9 @@ func (m *RepoAccessQuery) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovRepository(uint64(l))
 	}
+	if m.EnableOci {
+		n += 2
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -2653,6 +2676,26 @@ func (m *RepoAccessQuery) Unmarshal(dAtA []byte) error {
 			}
 			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnableOci", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRepository
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.EnableOci = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipRepository(dAtA[iNdEx:])
diff --git a/pkg/apis/application/v1alpha1/generated.pb.go b/pkg/apis/application/v1alpha1/generated.pb.go
index 7dcd8cf91..3cf7ef672 100644
--- a/pkg/apis/application/v1alpha1/generated.pb.go
+++ b/pkg/apis/application/v1alpha1/generated.pb.go
@@ -2541,13 +2541,13 @@ func init() {
 }
 
 var fileDescriptor_e7dc23c2911a1a00 = []byte{
-	// 5939 bytes of a gzipped FileDescriptorProto
+	// 5954 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe4, 0x3c, 0x6d, 0x6c, 0x24, 0xd9,
 	0x51, 0xd7, 0x33, 0xfe, 0x98, 0x29, 0x7f, 0xec, 0xfa, 0xed, 0xed, 0xc5, 0x59, 0x2e, 0xeb, 0x55,
 	0x9f, 0x92, 0x1c, 0x24, 0xb1, 0xb9, 0xe5, 0x80, 0x4b, 0x0e, 0x12, 0x3c, 0xf6, 0x7e, 0x78, 0xd7,
 	0xf6, 0xfa, 0xca, 0xbe, 0x5b, 0xe9, 0xf2, 0xc1, 0xb5, 0x7b, 0xde, 0xcc, 0xf4, 0x7a, 0xa6, 0x7b,
 	0xae, 0xbb, 0xc7, 0xbb, 0x3e, 0x92, 0x90, 0x40, 0x82, 0x4e, 0xe1, 0x2e, 0x42, 0x44, 0xe4, 0x0f,
-	0x09, 0x22, 0xf0, 0x03, 0x11, 0x89, 0x1f, 0x11, 0x12, 0x82, 0x9f, 0x04, 0x09, 0x4e, 0xfc, 0x40,
+	0x89, 0x44, 0xe0, 0x07, 0x22, 0x12, 0x3f, 0x22, 0x24, 0x04, 0x3f, 0x09, 0x12, 0x9c, 0xf8, 0x01,
 	0x51, 0x84, 0xe0, 0x84, 0x90, 0xe1, 0x36, 0x42, 0x42, 0xf0, 0x23, 0x20, 0xf8, 0xb5, 0xbf, 0xd0,
 	0xfb, 0x7e, 0xdd, 0x33, 0xb3, 0xb6, 0x77, 0x7a, 0x37, 0xa7, 0xf0, 0x6f, 0xa6, 0xaa, 0xba, 0xea,
 	0xf5, 0x7b, 0x55, 0xf5, 0xaa, 0xea, 0xd5, 0x6b, 0x58, 0x6b, 0x06, 0x69, 0xab, 0xb7, 0xbb, 0xe8,
@@ -2586,7 +2586,7 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0x49, 0xe7, 0xc7, 0xf9, 0x00, 0x96, 0x8e, 0xa7, 0x52, 0x57, 0xe2, 0xa8, 0xd7, 0xbd, 0x1e, 0x84,
 	0xf5, 0xda, 0x05, 0x29, 0x69, 0x7e, 0x65, 0x08, 0x63, 0x1c, 0x2a, 0x92, 0x7c, 0xcd, 0x81, 0x73,
 	0xa1, 0xd7, 0xa1, 0x49, 0xd7, 0x63, 0x8b, 0x2a, 0xd0, 0xb5, 0xb6, 0xe7, 0xef, 0xf1, 0x11, 0x4d,
-	0x3c, 0xd8, 0x88, 0x5c, 0x39, 0xa2, 0x73, 0x9b, 0x43, 0x59, 0xe3, 0x7d, 0xc4, 0x92, 0xdf, 0x77,
+	0x3c, 0xd8, 0x88, 0x5c, 0x39, 0xa2, 0x73, 0x9b, 0x43, 0x59, 0xe3, 0x7d, 0xc4, 0x92, 0xdf, 0x73,
 	0x60, 0x2e, 0x8a, 0xbb, 0x2d, 0x2f, 0xa4, 0x75, 0x85, 0x4d, 0xe6, 0x27, 0xb9, 0xc5, 0x7d, 0x72,
 	0x84, 0xf5, 0xb9, 0x91, 0xe7, 0xb9, 0x11, 0x85, 0x41, 0x1a, 0xc5, 0xdb, 0x34, 0x4d, 0x83, 0xb0,
 	0x99, 0xd4, 0xce, 0xde, 0x3d, 0x5c, 0x98, 0xeb, 0xa3, 0xc2, 0xfe, 0xc1, 0x90, 0x3b, 0x30, 0x95,
@@ -2595,13 +2595,13 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0x46, 0xf7, 0x11, 0x4b, 0xbe, 0xe4, 0xc0, 0x4c, 0x12, 0x34, 0x43, 0x2f, 0xed, 0xc5, 0xf4, 0x3a,
 	0x3d, 0x48, 0xe6, 0x81, 0x0f, 0xe4, 0xca, 0x28, 0x53, 0x62, 0xf1, 0xab, 0x9d, 0x95, 0x03, 0x9c,
 	0xb1, 0xa1, 0x09, 0x66, 0x85, 0x0e, 0xb2, 0x2f, 0xa3, 0xcd, 0x53, 0xc5, 0xda, 0x97, 0xd1, 0xe5,
-	0xa1, 0x22, 0xdd, 0xbf, 0x2a, 0xc1, 0xe9, 0xfc, 0x8e, 0x43, 0xfe, 0xd0, 0x81, 0x53, 0xb7, 0x6e,
+	0xa1, 0x22, 0xdd, 0xbf, 0x2c, 0xc1, 0xe9, 0xfc, 0x8e, 0x43, 0xfe, 0xc0, 0x81, 0x53, 0xb7, 0x6e,
 	0xa7, 0x3b, 0xd1, 0x1e, 0x0d, 0x93, 0xda, 0x01, 0x73, 0x10, 0xdc, 0xdd, 0x4e, 0x5d, 0x7c, 0xa5,
 	0xc0, 0x8d, 0x6d, 0xf1, 0x5a, 0x56, 0xc4, 0xa5, 0x30, 0x8d, 0x0f, 0x6a, 0xef, 0x91, 0x2f, 0x73,
 	0xea, 0xda, 0xcd, 0x1d, 0x1b, 0x8b, 0xf9, 0x11, 0x9d, 0x7b, 0xdd, 0x81, 0xc7, 0x07, 0xb1, 0x20,
 	0xa7, 0xa1, 0xbc, 0x47, 0x0f, 0x44, 0x14, 0x83, 0xec, 0x27, 0x79, 0x19, 0xc6, 0xf7, 0xbd, 0x76,
 	0x8f, 0xca, 0x68, 0x60, 0x75, 0x84, 0xb7, 0xd0, 0xc3, 0x42, 0xc1, 0xf2, 0x63, 0xa5, 0xe7, 0x1c,
-	0xf7, 0xaf, 0xcb, 0x30, 0x65, 0x6d, 0x0c, 0x8f, 0x20, 0xbc, 0x69, 0x67, 0xc2, 0x9b, 0x6b, 0xc5,
+	0xf7, 0xaf, 0xca, 0x30, 0x65, 0x6d, 0x0c, 0x8f, 0x20, 0xbc, 0x69, 0x67, 0xc2, 0x9b, 0x6b, 0xc5,
 	0x6c, 0x68, 0x43, 0xe3, 0x9b, 0x34, 0x17, 0xdf, 0xac, 0x17, 0x24, 0xef, 0xbe, 0x01, 0x0e, 0x79,
 	0x15, 0xaa, 0x51, 0x97, 0x05, 0xae, 0x6c, 0xb7, 0x1c, 0x1b, 0x79, 0xe5, 0x6e, 0x28, 0x5e, 0xb5,
 	0x99, 0xbb, 0x87, 0x0b, 0x55, 0xfd, 0x17, 0x8d, 0x14, 0xf7, 0x1f, 0x1d, 0x78, 0xdc, 0x1a, 0xe0,
@@ -2613,7 +2613,7 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0xc0, 0x44, 0x42, 0xe3, 0x7d, 0x1a, 0xcb, 0xb7, 0x33, 0xeb, 0xc1, 0xa1, 0x28, 0xb1, 0x64, 0x09,
 	0xaa, 0xda, 0xc1, 0xca, 0x77, 0x9c, 0x93, 0xa4, 0x55, 0xe3, 0x95, 0x0d, 0x0d, 0x9b, 0x34, 0xf6,
 	0x47, 0x46, 0x3a, 0x7a, 0xd2, 0x78, 0x22, 0xc1, 0x31, 0xee, 0x3f, 0x3b, 0x70, 0xca, 0x1a, 0xd5,
-	0x23, 0x08, 0x62, 0xf7, 0xb2, 0x41, 0xec, 0xe5, 0x62, 0x34, 0x79, 0x48, 0x14, 0xfb, 0xa7, 0x13,
+	0x23, 0x08, 0x62, 0xf7, 0xb2, 0x41, 0xec, 0xe5, 0x62, 0x34, 0x79, 0x48, 0x14, 0xfb, 0x27, 0x13,
 	0x30, 0x67, 0xeb, 0x3b, 0x77, 0xbe, 0x3c, 0x6d, 0xa2, 0xdd, 0xe8, 0x45, 0x5c, 0x97, 0x13, 0x6e,
 	0xd2, 0x26, 0x01, 0x46, 0x85, 0x67, 0x33, 0xd8, 0xf5, 0xd2, 0x96, 0x9c, 0x6d, 0x3d, 0x83, 0x5b,
 	0x5e, 0xda, 0x42, 0x8e, 0x21, 0x1f, 0x87, 0xd9, 0xd4, 0x8b, 0x9b, 0x34, 0x45, 0xba, 0x1f, 0x24,
@@ -2627,7 +2627,7 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0x45, 0x23, 0x96, 0xec, 0xc3, 0x44, 0xb7, 0xdd, 0x6b, 0x06, 0xe1, 0xfc, 0x14, 0x1f, 0x00, 0x16,
 	0x39, 0x80, 0x2d, 0xce, 0xb9, 0x06, 0xcc, 0x85, 0x88, 0xdf, 0x28, 0xa5, 0x91, 0xa7, 0x60, 0xdc,
 	0x6f, 0x79, 0x71, 0x3a, 0x3f, 0xcd, 0x95, 0x54, 0x5b, 0xcd, 0x0a, 0x03, 0xa2, 0xc0, 0xb9, 0x7f,
-	0xe3, 0xc0, 0xb9, 0xe1, 0x6f, 0x25, 0xcc, 0xc7, 0xef, 0xc5, 0x89, 0xf0, 0xc6, 0x15, 0xdb, 0x7c,
+	0xed, 0xc0, 0xb9, 0xe1, 0x6f, 0x25, 0xcc, 0xc7, 0xef, 0xc5, 0x89, 0xf0, 0xc6, 0x15, 0xdb, 0x7c,
 	0x38, 0x18, 0x15, 0x9e, 0x7c, 0x1e, 0x26, 0x6f, 0xc9, 0x75, 0x2e, 0x15, 0xbf, 0xce, 0xd7, 0xe4,
 	0x3a, 0x6b, 0xf9, 0xd7, 0xd4, 0x5a, 0x4b, 0xa1, 0xee, 0x61, 0x19, 0xce, 0x0e, 0x34, 0x0b, 0xb2,
 	0x08, 0xc0, 0xc3, 0x87, 0xcb, 0x01, 0xcb, 0xec, 0x44, 0x2e, 0x3b, 0xcb, 0x76, 0xfb, 0x97, 0x34,
@@ -2644,7 +2644,7 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0x0b, 0x07, 0x99, 0xe2, 0x72, 0x1f, 0xbf, 0x1e, 0xec, 0x26, 0xc8, 0xa1, 0xee, 0xf7, 0x9d, 0x01,
 	0xb3, 0x22, 0x1d, 0x21, 0xd3, 0x25, 0x1a, 0xee, 0x07, 0x71, 0x14, 0x76, 0x68, 0x98, 0xe6, 0x6b,
 	0x8d, 0x97, 0x0c, 0x0a, 0x6d, 0x3a, 0xf2, 0xab, 0x03, 0x0c, 0x60, 0x94, 0x32, 0x9b, 0x1c, 0xce,
-	0xb1, 0x6d, 0xc0, 0xfd, 0xdb, 0xf2, 0x00, 0xaf, 0xa4, 0x77, 0x17, 0x72, 0x11, 0x80, 0x45, 0x34,
+	0xb1, 0x6d, 0xc0, 0xfd, 0x9b, 0xf2, 0x00, 0xaf, 0xa4, 0x77, 0x17, 0x72, 0x11, 0x80, 0x45, 0x34,
 	0x5b, 0x31, 0x6d, 0x04, 0x77, 0xe4, 0x5b, 0x69, 0x96, 0x9b, 0x1a, 0x83, 0x16, 0x95, 0x7a, 0x66,
 	0xbb, 0xd7, 0x60, 0xcf, 0x94, 0xfa, 0x9f, 0x11, 0x18, 0xb4, 0xa8, 0xc8, 0xb3, 0x30, 0x11, 0x74,
 	0xbc, 0x26, 0x55, 0x73, 0xff, 0x24, 0xb3, 0xa7, 0x35, 0x0e, 0xb9, 0x77, 0xb8, 0x30, 0xab, 0x07,
@@ -2692,7 +2692,7 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0x59, 0xf3, 0xfc, 0xbd, 0xa8, 0xd1, 0x20, 0x1f, 0x86, 0x4a, 0xbd, 0x27, 0x0b, 0xdc, 0xe2, 0xdd,
 	0x74, 0xe9, 0x72, 0x55, 0xc2, 0x51, 0x53, 0x30, 0x65, 0x6a, 0x78, 0x7e, 0x1a, 0xc5, 0x7c, 0xcc,
 	0x65, 0xa1, 0x4c, 0x97, 0x39, 0x04, 0x25, 0x86, 0x65, 0x57, 0x1d, 0xef, 0x8e, 0x7a, 0x38, 0x9f,
-	0xa9, 0x6f, 0x18, 0x14, 0xda, 0x74, 0xee, 0x5f, 0x8e, 0xc3, 0xa4, 0x3c, 0x3d, 0x3a, 0x76, 0x39,
+	0xa9, 0x6f, 0x18, 0x14, 0xda, 0x74, 0xee, 0x5f, 0x8c, 0xc3, 0xa4, 0x3c, 0x3d, 0x3a, 0x76, 0x39,
 	0x58, 0xc5, 0xc9, 0xa5, 0xa1, 0x71, 0x72, 0x17, 0x26, 0x7c, 0xde, 0x60, 0x22, 0x37, 0xb1, 0x51,
 	0x0a, 0x16, 0x72, 0x74, 0xa2, 0x61, 0xc5, 0x8c, 0x49, 0xfc, 0x47, 0x29, 0x87, 0xbc, 0xe9, 0xc0,
 	0x29, 0x9f, 0x25, 0x76, 0xbe, 0xf1, 0xb3, 0x63, 0x23, 0x1f, 0x91, 0xac, 0x64, 0x39, 0x9a, 0x33,
@@ -2706,7 +2706,7 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0xad, 0x44, 0x3d, 0x59, 0x70, 0x28, 0x9b, 0x5a, 0x10, 0x66, 0xb0, 0x98, 0xa3, 0x26, 0x4b, 0x50,
 	0x65, 0x43, 0x16, 0x8f, 0x0a, 0xb3, 0xd3, 0x11, 0xe2, 0xf2, 0xd6, 0x9a, 0x7c, 0xca, 0xd0, 0x90,
 	0x08, 0xe6, 0xda, 0x5e, 0x92, 0xf2, 0x11, 0xb0, 0x78, 0xee, 0x01, 0x8f, 0x76, 0xf8, 0x41, 0xff,
-	0x7a, 0x9e, 0x11, 0xf6, 0xf3, 0x76, 0xff, 0xac, 0x0c, 0x33, 0x19, 0xe3, 0x60, 0x5e, 0xa5, 0x97,
+	0x7a, 0x9e, 0x11, 0xf6, 0xf3, 0x76, 0xff, 0xb4, 0x0c, 0x33, 0x19, 0xe3, 0x60, 0x5e, 0xa5, 0x97,
 	0xb0, 0x3d, 0x48, 0x27, 0xb1, 0xda, 0xab, 0xbc, 0x28, 0xe1, 0xa8, 0x29, 0x18, 0x75, 0xd7, 0x4b,
 	0x92, 0xdb, 0x51, 0x5c, 0x97, 0xa6, 0xac, 0xa9, 0xb7, 0x24, 0x1c, 0x35, 0x05, 0xf3, 0x2f, 0xbb,
 	0xd4, 0x8b, 0x69, 0xcc, 0x0f, 0x41, 0xf3, 0xfe, 0xa5, 0x66, 0x50, 0x68, 0xd3, 0x71, 0xbb, 0x4c,
@@ -2738,7 +2738,7 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0x13, 0xed, 0x30, 0x20, 0x0a, 0x1c, 0x5b, 0x94, 0xa4, 0xb7, 0xcb, 0xeb, 0x0e, 0xb9, 0xb3, 0x83,
 	0x6d, 0x01, 0x46, 0x85, 0x67, 0xa4, 0x7b, 0xf4, 0x60, 0x95, 0x79, 0xf0, 0xdc, 0xe9, 0xde, 0x75,
 	0x01, 0x46, 0x85, 0x77, 0xef, 0x3a, 0x40, 0xb2, 0xd3, 0xf1, 0x08, 0x36, 0x81, 0x30, 0xbb, 0x09,
-	0x8c, 0x52, 0x1f, 0xca, 0x8e, 0x7d, 0xc8, 0x5e, 0xf0, 0x07, 0x0e, 0x4c, 0xdb, 0x15, 0x42, 0xd2,
+	0x8c, 0x52, 0x1f, 0xca, 0x8e, 0x7d, 0xc8, 0x5e, 0xf0, 0xfb, 0x0e, 0x4c, 0xdb, 0x15, 0x42, 0xd2,
 	0xcc, 0x19, 0xc2, 0x8d, 0xac, 0x21, 0xdc, 0x3b, 0x5c, 0xf8, 0xc5, 0x41, 0xf7, 0x36, 0x9a, 0x41,
 	0x1a, 0x75, 0x93, 0x8f, 0xd0, 0xb0, 0x19, 0x84, 0x94, 0xa7, 0xdf, 0xa2, 0xb2, 0x98, 0x29, 0x3f,
 	0xae, 0x44, 0x75, 0xfa, 0x00, 0x96, 0xe4, 0xde, 0x84, 0xb9, 0xbe, 0xf3, 0xdc, 0x63, 0x28, 0xfd,
@@ -2774,7 +2774,7 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0xe3, 0x4a, 0x2d, 0x6a, 0x16, 0x15, 0xbe, 0x6b, 0x6a, 0x57, 0x86, 0x1a, 0x83, 0x16, 0x95, 0xfb,
 	0x79, 0x38, 0x93, 0xbf, 0x13, 0x24, 0x43, 0xf7, 0x66, 0x1c, 0xf5, 0xba, 0xf9, 0x8d, 0x83, 0xdf,
 	0x1c, 0x41, 0x81, 0x63, 0x0e, 0x7d, 0x2f, 0x08, 0xeb, 0x79, 0x87, 0x7e, 0x3d, 0x08, 0xeb, 0xc8,
-	0x31, 0xc7, 0xe8, 0xe2, 0xfe, 0x73, 0x07, 0x2e, 0x1c, 0x75, 0x75, 0x89, 0x3c, 0x09, 0x63, 0xb7,
+	0x31, 0xc7, 0xe8, 0xe2, 0xfe, 0x33, 0x07, 0x2e, 0x1c, 0x75, 0x75, 0x89, 0x3c, 0x09, 0x63, 0xb7,
 	0xbd, 0x38, 0x94, 0x3d, 0x9b, 0xdc, 0x63, 0xdc, 0xf4, 0xe2, 0x10, 0x39, 0x94, 0xec, 0xc3, 0x84,
 	0x68, 0x58, 0x90, 0x61, 0xef, 0x66, 0x81, 0xb7, 0xa8, 0x58, 0xec, 0xab, 0xb3, 0x39, 0xd1, 0x29,
 	0x81, 0x52, 0x9a, 0x7b, 0x0d, 0xc8, 0x8d, 0x7d, 0x1a, 0xc7, 0x41, 0xdd, 0x6a, 0xaf, 0x20, 0xcf,
@@ -2791,7 +2791,7 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0x03, 0xd5, 0x85, 0x46, 0x53, 0x8c, 0x96, 0x04, 0xd8, 0xff, 0x0c, 0x59, 0x85, 0xd3, 0x19, 0x20,
 	0x1b, 0x88, 0x48, 0x4f, 0xe7, 0x25, 0x9f, 0xd3, 0x19, 0x3e, 0x6c, 0x2c, 0x7d, 0x4f, 0xb8, 0x6f,
 	0x3b, 0x30, 0xa3, 0x27, 0xf5, 0x11, 0xe4, 0xaa, 0x41, 0x36, 0x57, 0x5d, 0x1d, 0x69, 0x9f, 0x97,
-	0xc3, 0x1e, 0x12, 0x8e, 0xff, 0xde, 0x04, 0x00, 0xbf, 0xd4, 0x1b, 0xf0, 0xbe, 0x91, 0x0b, 0x30,
+	0xc3, 0x1e, 0x12, 0x8e, 0xff, 0xdd, 0x04, 0x00, 0xbf, 0xd4, 0x1b, 0xf0, 0xbe, 0x91, 0x0b, 0x30,
 	0x16, 0xd3, 0x6e, 0x94, 0xb7, 0x2d, 0x46, 0x81, 0x1c, 0xf3, 0xee, 0xd5, 0x99, 0x41, 0x75, 0xfe,
 	0xf1, 0x1f, 0x61, 0x9d, 0x7f, 0x1b, 0xce, 0x06, 0x61, 0x42, 0xfd, 0x5e, 0x2c, 0x5d, 0xe0, 0xd5,
 	0x28, 0xd1, 0xfa, 0x57, 0xa9, 0xbd, 0x4f, 0x32, 0x3a, 0xbb, 0x36, 0x88, 0x08, 0x07, 0x3f, 0xcb,
@@ -2800,120 +2800,121 @@ var fileDescriptor_e7dc23c2911a1a00 = []byte{
 	0x1a, 0x9a, 0xc1, 0x76, 0x57, 0x2d, 0xc8, 0xee, 0xe0, 0xa4, 0x76, 0xa7, 0xb3, 0xaf, 0xa9, 0xa1,
 	0xb7, 0xc3, 0xd4, 0x5e, 0x30, 0x3d, 0x74, 0x2f, 0xf8, 0x38, 0xcc, 0x06, 0x61, 0x8b, 0xc6, 0x41,
 	0x4a, 0xeb, 0xdc, 0x10, 0xe6, 0x67, 0xf8, 0x44, 0xe8, 0x93, 0xca, 0xb5, 0x0c, 0x16, 0x73, 0xd4,
-	0xee, 0xeb, 0x25, 0x38, 0x6b, 0x0c, 0x84, 0x8d, 0x2c, 0x68, 0x30, 0x2d, 0xe1, 0xad, 0xc9, 0xe2,
-	0x70, 0xc6, 0xfa, 0xb8, 0x83, 0x0e, 0x29, 0xb6, 0x35, 0x06, 0x2d, 0x2a, 0xb6, 0x7e, 0x3e, 0x8d,
-	0x79, 0xdb, 0x44, 0xde, 0x7a, 0x56, 0x24, 0x1c, 0x35, 0x05, 0xff, 0x7e, 0x04, 0x8d, 0x53, 0x59,
-	0x6b, 0xcb, 0x9f, 0x0a, 0xae, 0x18, 0x14, 0xda, 0x74, 0x6c, 0x1f, 0xf3, 0xd5, 0xe2, 0x31, 0x0b,
-	0x9a, 0x16, 0xfb, 0x98, 0x5e, 0x2f, 0x8d, 0x55, 0xc3, 0xe1, 0xa7, 0x49, 0xe3, 0xfd, 0xc3, 0xe1,
-	0xa9, 0x87, 0xa6, 0x70, 0xff, 0xcb, 0x81, 0xf7, 0x0e, 0x9c, 0x8a, 0x47, 0xe0, 0x12, 0x7b, 0x59,
-	0x97, 0xb8, 0x35, 0xa2, 0x4b, 0xec, 0x7b, 0x85, 0x21, 0xee, 0xf1, 0x1f, 0x1c, 0x98, 0x35, 0xf4,
-	0x8f, 0xe0, 0x3d, 0x1b, 0xc5, 0x7d, 0x0c, 0xc2, 0x8c, 0x5b, 0x9c, 0xea, 0x67, 0x5e, 0xec, 0x6d,
-	0xfe, 0x62, 0x22, 0x90, 0x5b, 0xf6, 0xd5, 0x5d, 0xcc, 0x23, 0xe2, 0xaa, 0x7d, 0x98, 0xe0, 0x9d,
-	0xfb, 0x49, 0x01, 0xd1, 0x64, 0x56, 0x38, 0x2f, 0x9d, 0x98, 0x68, 0x92, 0xff, 0x4d, 0x50, 0x4a,
-	0xe3, 0xfd, 0x3c, 0x41, 0xc2, 0x9c, 0x54, 0x5d, 0x96, 0x78, 0x4c, 0x3f, 0x8f, 0x84, 0xa3, 0xa6,
-	0x70, 0x3b, 0x30, 0x9f, 0x65, 0xbe, 0x4a, 0x1b, 0x3c, 0x49, 0x3f, 0xd6, 0x3b, 0xb2, 0x84, 0x95,
-	0x3f, 0xb5, 0xde, 0xf3, 0xf2, 0xb7, 0x31, 0x97, 0x15, 0x02, 0x0d, 0x8d, 0xfb, 0xc7, 0x0e, 0x9c,
-	0x19, 0xf0, 0x32, 0x05, 0x96, 0xb6, 0x52, 0x63, 0xfc, 0x43, 0x6e, 0xc8, 0xd6, 0x69, 0xc3, 0x53,
-	0x09, 0xa1, 0x95, 0x3e, 0xae, 0x0a, 0x30, 0x2a, 0xbc, 0xfb, 0x1f, 0x0e, 0x9c, 0xca, 0x8e, 0x35,
-	0x21, 0xd7, 0x80, 0x88, 0x97, 0x59, 0x0d, 0x12, 0x3f, 0xda, 0xa7, 0xf1, 0x01, 0x7b, 0x73, 0x31,
-	0xea, 0x73, 0x92, 0x13, 0x59, 0xee, 0xa3, 0xc0, 0x01, 0x4f, 0x91, 0xaf, 0xf0, 0xb3, 0x42, 0x35,
-	0xdb, 0x4a, 0x4d, 0xb6, 0x0b, 0x53, 0x13, 0xb3, 0x92, 0x76, 0x38, 0xaf, 0xe5, 0xa1, 0x2d, 0xdc,
-	0xfd, 0x61, 0x19, 0xa6, 0xd5, 0xe3, 0x3c, 0xfd, 0x28, 0x28, 0x71, 0xcb, 0xdc, 0xd7, 0x2d, 0x9f,
-	0xe0, 0xbe, 0xee, 0xd8, 0xfd, 0x12, 0x16, 0x71, 0x7f, 0xd4, 0x84, 0x2d, 0x96, 0xa3, 0xdf, 0x31,
-	0x28, 0xb4, 0xe9, 0xd8, 0x48, 0xda, 0xc1, 0x3e, 0x15, 0x0f, 0x4d, 0x64, 0x47, 0xb2, 0xae, 0x10,
-	0x68, 0x68, 0xd8, 0x48, 0xea, 0x41, 0xa3, 0xc1, 0x43, 0x07, 0x6b, 0x24, 0x6c, 0x76, 0x90, 0x63,
-	0x18, 0x45, 0x2b, 0x8a, 0xf6, 0x64, 0xb4, 0xa0, 0x29, 0xae, 0x46, 0xd1, 0x1e, 0x72, 0x0c, 0xd9,
-	0x80, 0x33, 0x61, 0x14, 0x77, 0xbc, 0x76, 0xf0, 0x1a, 0xad, 0x6b, 0x29, 0x32, 0x4a, 0xf8, 0x09,
-	0xf9, 0xc0, 0x99, 0xcd, 0x7e, 0x12, 0x1c, 0xf4, 0x1c, 0x53, 0xbf, 0x6e, 0x4c, 0xeb, 0x81, 0x9f,
-	0xda, 0xdc, 0x20, 0xab, 0x7e, 0x5b, 0x7d, 0x14, 0x38, 0xe0, 0x29, 0xf7, 0x3f, 0xf9, 0x06, 0x35,
-	0xa4, 0xab, 0xff, 0x91, 0xe5, 0xed, 0x59, 0x05, 0x19, 0x3b, 0x86, 0x82, 0xb0, 0xbc, 0x38, 0x89,
-	0x42, 0x9d, 0x17, 0x8f, 0x0f, 0xcd, 0x8b, 0x2d, 0x2a, 0xf7, 0xbb, 0xe3, 0xf0, 0x84, 0x6e, 0x07,
-	0xa5, 0xe9, 0xed, 0x28, 0xde, 0x0b, 0xc2, 0x26, 0x3f, 0xe6, 0xf8, 0xa6, 0x03, 0xd3, 0x42, 0x51,
-	0xe4, 0xbd, 0x24, 0x51, 0xd6, 0xf7, 0x8b, 0x68, 0x3c, 0xcd, 0x48, 0x5a, 0xdc, 0xb1, 0xa4, 0xe4,
-	0xee, 0x24, 0xd9, 0x28, 0xcc, 0x0c, 0x87, 0xbc, 0x06, 0xa0, 0xee, 0x4b, 0x37, 0x8a, 0xb8, 0x32,
-	0xae, 0x06, 0x87, 0xb4, 0x61, 0x42, 0xb0, 0x1d, 0x2d, 0x01, 0x2d, 0x69, 0xe4, 0xcb, 0x0e, 0x4c,
-	0xb4, 0xc5, 0xac, 0x88, 0x32, 0xed, 0xa7, 0x8b, 0x9f, 0x15, 0x7b, 0x3e, 0xf4, 0xa6, 0x26, 0x67,
-	0x42, 0x0a, 0x27, 0x08, 0x93, 0x41, 0xd8, 0x8c, 0x69, 0xa2, 0x2a, 0x08, 0x1f, 0xb4, 0xc2, 0x88,
-	0x45, 0x3f, 0x8a, 0x29, 0x0f, 0x1a, 0x22, 0xaf, 0x5e, 0xf3, 0xda, 0x5e, 0xe8, 0xd3, 0x78, 0x4d,
-	0x90, 0x1b, 0xff, 0x2e, 0x01, 0xa8, 0x18, 0xf5, 0x75, 0x53, 0x8f, 0x1f, 0xa7, 0x9b, 0xfa, 0xdc,
-	0x27, 0x60, 0xae, 0x6f, 0x19, 0x4f, 0x72, 0xed, 0xeb, 0xdc, 0x47, 0x61, 0xea, 0x41, 0x6f, 0x8c,
-	0xfd, 0xc9, 0x84, 0x71, 0xd2, 0x9b, 0x51, 0x9d, 0xb7, 0x11, 0xc7, 0x66, 0x35, 0x65, 0x84, 0x55,
-	0x94, 0x6e, 0x58, 0x77, 0x6b, 0x35, 0x10, 0x6d, 0x79, 0x4c, 0x33, 0xbb, 0x5e, 0x4c, 0xc3, 0x87,
-	0xaa, 0x99, 0x5b, 0x5a, 0x02, 0x5a, 0xd2, 0x08, 0xcd, 0x9c, 0x1e, 0xac, 0x8c, 0x78, 0x7a, 0xc0,
-	0xc2, 0xbd, 0x81, 0x1d, 0x9f, 0x6f, 0x3a, 0x30, 0x1b, 0x66, 0xf4, 0x55, 0x16, 0x92, 0x5f, 0x28,
-	0xdc, 0x10, 0xc4, 0xdd, 0x89, 0x2c, 0x0c, 0x73, 0xc2, 0xc9, 0x32, 0x9c, 0x52, 0x2b, 0x90, 0x6d,
-	0xe7, 0xd5, 0xb9, 0x36, 0x66, 0xd1, 0x98, 0xa7, 0xb7, 0xee, 0x03, 0x4c, 0x0c, 0xbb, 0x0f, 0x40,
-	0xf6, 0xf4, 0xd5, 0x9f, 0xc9, 0x62, 0xaf, 0xfe, 0xc0, 0x80, 0x6b, 0x3f, 0x37, 0xa1, 0xea, 0xc7,
-	0xd4, 0x4b, 0x1f, 0xf0, 0x3a, 0x08, 0xff, 0xc2, 0xc0, 0x8a, 0x62, 0x80, 0x86, 0x97, 0xfb, 0xf5,
-	0x32, 0x9c, 0x56, 0xd3, 0xa1, 0x2a, 0xac, 0x6c, 0xc3, 0x11, 0x72, 0x4d, 0xe4, 0xa6, 0x37, 0x9c,
-	0xab, 0x0a, 0x81, 0x86, 0x86, 0x85, 0x8c, 0x22, 0x7a, 0x4b, 0xf2, 0x27, 0x0e, 0x32, 0x2a, 0x44,
-	0x85, 0x27, 0x5f, 0x1f, 0x78, 0xfb, 0xae, 0x80, 0xf3, 0xb5, 0xbe, 0xf2, 0xf0, 0x09, 0xaf, 0xdd,
-	0xbd, 0xe1, 0xc0, 0xa9, 0xbd, 0xcc, 0x91, 0xae, 0x72, 0xa4, 0xa3, 0xf4, 0x76, 0x64, 0x0f, 0x89,
-	0x8d, 0x0a, 0x66, 0xe1, 0x09, 0xe6, 0x45, 0xbb, 0xff, 0xed, 0x80, 0xed, 0x55, 0x8e, 0x17, 0x6d,
-	0x58, 0x77, 0x73, 0x4b, 0xf7, 0xbf, 0x9b, 0xab, 0x03, 0x93, 0xf2, 0xf1, 0xe2, 0xd2, 0xb1, 0x13,
-	0xc4, 0xa5, 0xe3, 0x43, 0x23, 0x99, 0xf7, 0x41, 0xb9, 0x17, 0xd4, 0x65, 0x68, 0x69, 0xea, 0xc7,
-	0x6b, 0xab, 0xc8, 0xe0, 0xee, 0x5f, 0x8c, 0x9b, 0x24, 0x52, 0x1e, 0x10, 0xfd, 0x58, 0xbc, 0x76,
-	0x43, 0xb7, 0xea, 0x88, 0x37, 0xdf, 0xec, 0x6b, 0xd5, 0xf9, 0x85, 0x93, 0x9f, 0xfd, 0x89, 0x09,
-	0x1a, 0xd6, 0xa9, 0x33, 0x79, 0xc4, 0xc1, 0xdf, 0x2d, 0xa8, 0xb0, 0xe8, 0x9b, 0xd7, 0x81, 0x2a,
-	0x99, 0x41, 0x55, 0xae, 0x4a, 0xf8, 0xbd, 0xc3, 0x85, 0x8f, 0x9d, 0x7c, 0x58, 0xea, 0x69, 0xd4,
-	0xfc, 0x49, 0x02, 0x55, 0xf6, 0x9b, 0x9f, 0x51, 0xca, 0xb8, 0xfe, 0x45, 0xed, 0x4e, 0x14, 0xa2,
-	0x90, 0x03, 0x50, 0x23, 0x87, 0x84, 0x50, 0xe5, 0x77, 0x7e, 0xb9, 0x50, 0x11, 0xfe, 0x6f, 0xe9,
-	0xd3, 0x42, 0x85, 0xb8, 0x77, 0xb8, 0xf0, 0xfc, 0xc9, 0x85, 0xea, 0xc7, 0xd1, 0x88, 0x70, 0xdf,
-	0x29, 0x1b, 0xdd, 0x95, 0x1d, 0x5a, 0x3f, 0x16, 0xba, 0xfb, 0x5c, 0x4e, 0x77, 0x2f, 0xf4, 0xe9,
-	0xee, 0xac, 0xb9, 0x23, 0x9b, 0xd1, 0xc6, 0x47, 0xba, 0x41, 0x1e, 0x9d, 0x67, 0xf2, 0xb0, 0xe0,
-	0xd5, 0x5e, 0x10, 0xd3, 0x64, 0x2b, 0xee, 0x85, 0x41, 0xd8, 0xe4, 0xba, 0x58, 0xb1, 0xc3, 0x82,
-	0x0c, 0x1a, 0xf3, 0xf4, 0xee, 0xb7, 0xf9, 0xb9, 0x8d, 0xd5, 0xe8, 0xc0, 0x96, 0xb8, 0xcd, 0x6f,
-	0x4e, 0x8b, 0xde, 0x2a, 0xbd, 0xc4, 0xe2, 0xba, 0xb4, 0xc0, 0x91, 0x14, 0x26, 0x77, 0xc5, 0x4d,
-	0xb2, 0x02, 0xba, 0x73, 0xe5, 0x9d, 0x34, 0x7e, 0xfb, 0x47, 0x5d, 0x50, 0xbb, 0x67, 0x7e, 0xa2,
-	0x12, 0xe5, 0x7e, 0xa3, 0x0c, 0xa7, 0x72, 0x17, 0x7c, 0xc9, 0x87, 0xa1, 0xa2, 0x6e, 0x70, 0xe7,
-	0xcb, 0xc5, 0xfa, 0xcb, 0x53, 0x9a, 0x82, 0x7c, 0x06, 0xa0, 0x4e, 0xbb, 0xed, 0xe8, 0x80, 0x47,
-	0x1d, 0x63, 0x27, 0x8e, 0x3a, 0x74, 0x7c, 0xba, 0xaa, 0xb9, 0xa0, 0xc5, 0x51, 0x76, 0x93, 0x8d,
-	0x8b, 0x4b, 0x72, 0xd9, 0x6e, 0x32, 0xab, 0x37, 0x7d, 0xe2, 0x11, 0xf6, 0xa6, 0x07, 0x70, 0x4a,
-	0x8c, 0x4f, 0xf7, 0x13, 0x3c, 0x40, 0xdb, 0xc0, 0x19, 0xa6, 0x4b, 0xab, 0x59, 0x36, 0x98, 0xe7,
-	0xeb, 0x7e, 0xb5, 0xc4, 0x02, 0x2f, 0x31, 0xd3, 0x1b, 0xaa, 0x5a, 0xfb, 0x01, 0x98, 0xf0, 0x7a,
-	0x69, 0x2b, 0xea, 0xbb, 0xd3, 0xb7, 0xcc, 0xa1, 0x28, 0xb1, 0x64, 0x1d, 0xc6, 0xea, 0x5e, 0xaa,
-	0xbe, 0x93, 0x78, 0x92, 0xc1, 0x99, 0x1a, 0x8d, 0x97, 0x52, 0xe4, 0x5c, 0xc8, 0x93, 0x30, 0x96,
-	0x7a, 0xcd, 0xcc, 0x57, 0x62, 0x76, 0xbc, 0x66, 0x82, 0x1c, 0x6a, 0x6f, 0x2a, 0x63, 0x47, 0x6c,
-	0x2a, 0xcf, 0x5b, 0xdf, 0xee, 0xb4, 0xce, 0x00, 0xfa, 0x3f, 0xb9, 0xc9, 0xe3, 0xf6, 0x2c, 0xad,
-	0xfb, 0x33, 0x30, 0x6d, 0x7f, 0x92, 0xf3, 0x58, 0x1d, 0xcd, 0xee, 0xbf, 0x8c, 0xc1, 0x4c, 0xa6,
-	0xe7, 0x24, 0xa3, 0xe2, 0xce, 0x91, 0x2a, 0xfe, 0x14, 0x8c, 0x77, 0xe3, 0x5e, 0x48, 0x65, 0x2b,
-	0x91, 0x16, 0xc2, 0x2c, 0x9e, 0xa2, 0xc0, 0xb1, 0x55, 0xa9, 0xc7, 0x07, 0xd8, 0x0b, 0x65, 0xb1,
-	0x58, 0xaf, 0xca, 0x2a, 0x87, 0xa2, 0xc4, 0x92, 0xcf, 0xc1, 0x74, 0xc2, 0x5d, 0xa1, 0x70, 0x0e,
-	0xd2, 0x62, 0xae, 0x8c, 0xfc, 0xf5, 0x01, 0xd9, 0x54, 0xc5, 0xd3, 0x6e, 0x1b, 0x82, 0x19, 0x71,
-	0xe4, 0x8b, 0x8e, 0xfd, 0xc5, 0x85, 0x89, 0x91, 0xcf, 0x35, 0xf2, 0xbd, 0x3c, 0xc2, 0x74, 0xee,
-	0xff, 0xe1, 0x85, 0xae, 0x36, 0xdb, 0xc9, 0x87, 0x60, 0xb6, 0x30, 0xc0, 0x64, 0x3f, 0x04, 0xd5,
-	0x8e, 0x17, 0x06, 0x0d, 0x9a, 0xa4, 0xe2, 0xf3, 0xb9, 0x55, 0x91, 0xed, 0x6c, 0x28, 0x20, 0x1a,
-	0x3c, 0xff, 0x36, 0x35, 0x7f, 0x2b, 0x91, 0xab, 0x54, 0xad, 0x6f, 0x53, 0x1b, 0x30, 0xda, 0x34,
-	0xee, 0x77, 0x1c, 0x38, 0x3b, 0x70, 0x26, 0xde, 0xbd, 0xf5, 0x3f, 0xf7, 0x3b, 0x25, 0x38, 0x33,
-	0xa0, 0x13, 0x8b, 0xec, 0x3f, 0x9c, 0x4f, 0x72, 0xc8, 0x3e, 0xaf, 0x99, 0xa1, 0x5a, 0x71, 0xb2,
-	0x6d, 0xc7, 0xb8, 0xfe, 0xf2, 0xa3, 0x73, 0xfd, 0xee, 0x1f, 0x95, 0xc0, 0xfa, 0x60, 0x0c, 0xf9,
-	0x15, 0xbb, 0xcf, 0xd0, 0x29, 0xa4, 0x2f, 0x4e, 0x70, 0xd6, 0x4d, 0x8a, 0x62, 0xbe, 0x06, 0xf5,
-	0x2c, 0xe6, 0xd5, 0xb4, 0x74, 0xb4, 0x9a, 0x92, 0x40, 0xb5, 0x72, 0x96, 0x0b, 0x6e, 0xe5, 0xac,
-	0xf6, 0xb5, 0x71, 0x7e, 0xc3, 0x11, 0xda, 0x95, 0x7b, 0x1f, 0xe3, 0x4b, 0x9d, 0xfb, 0xf8, 0xd2,
-	0x0f, 0x43, 0x25, 0xa1, 0xed, 0x06, 0x8b, 0xde, 0xa4, 0xcf, 0xd5, 0xaa, 0xb0, 0x2d, 0xe1, 0xa8,
-	0x29, 0xc8, 0x45, 0x00, 0xaf, 0xdd, 0x8e, 0x6e, 0x5f, 0xea, 0x74, 0xd3, 0x03, 0xe9, 0x7d, 0x75,
-	0x54, 0xb1, 0xac, 0x31, 0x68, 0x51, 0xb9, 0x3f, 0x74, 0xc4, 0x42, 0xca, 0x20, 0xfc, 0xb9, 0xdc,
-	0x35, 0x89, 0xe3, 0xc7, 0xaf, 0x07, 0x00, 0xbe, 0xbe, 0x2c, 0x57, 0xc0, 0xa7, 0x64, 0xcc, 0xcd,
-	0x3b, 0xfb, 0x43, 0x27, 0x0a, 0x86, 0x96, 0xb0, 0x8c, 0xc1, 0x94, 0x8f, 0x32, 0x18, 0xf7, 0xdf,
-	0x1d, 0xc8, 0xec, 0x0b, 0xa4, 0x03, 0xe3, 0x6c, 0x04, 0x07, 0x05, 0xdc, 0xeb, 0xb3, 0xf9, 0x32,
-	0x63, 0x92, 0x0a, 0xc1, 0x7f, 0xa2, 0x90, 0x42, 0x02, 0x19, 0x7b, 0x97, 0x46, 0xbe, 0x3f, 0x6a,
-	0x4b, 0x63, 0xa1, 0xbb, 0xfc, 0x2c, 0xa9, 0x0e, 0xe2, 0xdd, 0xe7, 0x60, 0xae, 0x6f, 0x44, 0xbc,
-	0xf3, 0x3e, 0x52, 0xd7, 0x18, 0x2d, 0xc5, 0xe3, 0xb7, 0x37, 0x50, 0xe0, 0x58, 0xec, 0x7e, 0x3a,
-	0xcf, 0x9e, 0xfc, 0x8e, 0x03, 0x73, 0x49, 0x9e, 0xdf, 0x43, 0x99, 0x35, 0x5d, 0x8b, 0xea, 0x43,
-	0x61, 0xff, 0x08, 0xdc, 0xbf, 0x93, 0xce, 0x48, 0x7c, 0xab, 0x5d, 0x6f, 0x22, 0xce, 0xd0, 0x4d,
-	0x84, 0x99, 0x95, 0xdf, 0xa2, 0xf5, 0x5e, 0xbb, 0xaf, 0x0f, 0x64, 0x5b, 0xc2, 0x51, 0x53, 0x64,
-	0xbe, 0x67, 0x51, 0x3e, 0xf2, 0x7b, 0x16, 0xcf, 0xc2, 0xb4, 0x7d, 0xe3, 0x96, 0x17, 0xc5, 0xe4,
-	0x21, 0x80, 0x7d, 0x39, 0x17, 0x33, 0x54, 0xb9, 0xaf, 0x22, 0x8c, 0x1f, 0xf9, 0x55, 0x84, 0xa7,
-	0xa1, 0x22, 0xbf, 0x7e, 0xae, 0x8a, 0xae, 0xa2, 0xc9, 0x44, 0xc2, 0x50, 0x63, 0x99, 0x53, 0xe8,
-	0x78, 0x61, 0xcf, 0x6b, 0xb3, 0x19, 0x92, 0x5d, 0x4b, 0xda, 0xa0, 0x36, 0x34, 0x06, 0x2d, 0x2a,
-	0x66, 0x22, 0xf9, 0xdb, 0xe6, 0x99, 0xde, 0x27, 0xe7, 0xc8, 0xde, 0xa7, 0x6c, 0x77, 0x4e, 0xe9,
-	0x58, 0xdd, 0x39, 0x76, 0xe3, 0x4c, 0xf9, 0xbe, 0x8d, 0x33, 0xef, 0x37, 0xb7, 0xdd, 0x44, 0x87,
-	0xcd, 0xd4, 0xa0, 0x9b, 0x6e, 0xc4, 0x85, 0x09, 0xdf, 0xd3, 0xcd, 0x8b, 0xd3, 0x22, 0x20, 0x5a,
-	0x59, 0xe6, 0x44, 0x12, 0x53, 0x5b, 0x7c, 0xeb, 0x9d, 0xf3, 0x8f, 0x7d, 0xef, 0x9d, 0xf3, 0x8f,
-	0xbd, 0xfd, 0xce, 0xf9, 0xc7, 0xbe, 0x70, 0xf7, 0xbc, 0xf3, 0xd6, 0xdd, 0xf3, 0xce, 0xf7, 0xee,
-	0x9e, 0x77, 0xde, 0xbe, 0x7b, 0xde, 0xf9, 0xd7, 0xbb, 0xe7, 0x9d, 0xdf, 0xfa, 0xc1, 0xf9, 0xc7,
-	0x5e, 0xae, 0x28, 0x5d, 0xfd, 0xbf, 0x00, 0x00, 0x00, 0xff, 0xff, 0x8b, 0x07, 0xe1, 0xc4, 0xde,
-	0x67, 0x00, 0x00,
+	0x66, 0x0e, 0x6f, 0xac, 0xac, 0xcd, 0xcf, 0x0e, 0x9a, 0xc3, 0x1b, 0x2b, 0x6b, 0x68, 0x68, 0xdc,
+	0xd7, 0x4b, 0x70, 0xd6, 0x58, 0x14, 0x7b, 0x95, 0xa0, 0xc1, 0xd4, 0x8a, 0xf7, 0x32, 0x8b, 0xd3,
+	0x1c, 0xeb, 0x6b, 0x10, 0x3a, 0x06, 0xd9, 0xd6, 0x18, 0xb4, 0xa8, 0xd8, 0x82, 0xfb, 0x34, 0xe6,
+	0x7d, 0x16, 0x79, 0x73, 0x5b, 0x91, 0x70, 0xd4, 0x14, 0xfc, 0x83, 0x13, 0x34, 0x4e, 0x65, 0x71,
+	0x2e, 0x7f, 0x8c, 0xb8, 0x62, 0x50, 0x68, 0xd3, 0xb1, 0x8d, 0xcf, 0x57, 0xab, 0xcd, 0x4c, 0x6e,
+	0x5a, 0x6c, 0x7c, 0x7a, 0x81, 0x35, 0x56, 0x0d, 0x87, 0x1f, 0x3f, 0x8d, 0xf7, 0x0f, 0x87, 0xe7,
+	0x2a, 0x9a, 0xc2, 0xfd, 0x2f, 0x07, 0xde, 0x3b, 0x70, 0x2a, 0x1e, 0x81, 0x0f, 0xed, 0x65, 0x7d,
+	0xe8, 0xd6, 0x88, 0x3e, 0xb4, 0xef, 0x15, 0x86, 0xf8, 0xd3, 0x7f, 0x70, 0x60, 0xd6, 0xd0, 0x3f,
+	0x82, 0xf7, 0x6c, 0x14, 0xf7, 0xf5, 0x08, 0x33, 0x6e, 0xd1, 0x06, 0x90, 0x79, 0xb1, 0xb7, 0xf9,
+	0x8b, 0x89, 0xc8, 0x6f, 0xd9, 0x57, 0x97, 0x37, 0x8f, 0x08, 0xc4, 0xf6, 0x61, 0x82, 0xb7, 0xfa,
+	0x27, 0x05, 0x84, 0x9f, 0x59, 0xe1, 0xbc, 0xd6, 0x62, 0xc2, 0x4f, 0xfe, 0x37, 0x41, 0x29, 0x8d,
+	0x37, 0x00, 0x05, 0x09, 0xb3, 0xc8, 0xba, 0xac, 0x09, 0x99, 0x06, 0x20, 0x09, 0x47, 0x4d, 0xe1,
+	0x76, 0x60, 0x3e, 0xcb, 0x7c, 0x95, 0x36, 0x78, 0x56, 0x7f, 0xac, 0x77, 0x64, 0x19, 0x2e, 0x7f,
+	0x6a, 0xbd, 0xe7, 0xe5, 0xaf, 0x6f, 0x2e, 0x2b, 0x04, 0x1a, 0x1a, 0xf7, 0x8f, 0x1c, 0x38, 0x33,
+	0xe0, 0x65, 0x0a, 0xac, 0x85, 0xa5, 0xc6, 0xf8, 0x87, 0x5c, 0xa9, 0xad, 0xd3, 0x86, 0xa7, 0x32,
+	0x48, 0x2b, 0xdf, 0x5c, 0x15, 0x60, 0x54, 0x78, 0xf7, 0x3f, 0x1c, 0x38, 0x95, 0x1d, 0x6b, 0x42,
+	0xae, 0x01, 0x11, 0x2f, 0xb3, 0x1a, 0x24, 0x7e, 0xb4, 0x4f, 0xe3, 0x03, 0xf6, 0xe6, 0x62, 0xd4,
+	0xe7, 0x24, 0x27, 0xb2, 0xdc, 0x47, 0x81, 0x03, 0x9e, 0x22, 0x5f, 0xe1, 0x87, 0x8b, 0x6a, 0xb6,
+	0x95, 0x9a, 0x6c, 0x17, 0xa6, 0x26, 0x66, 0x25, 0xed, 0xf8, 0x5f, 0xcb, 0x43, 0x5b, 0xb8, 0xfb,
+	0xc3, 0x32, 0x4c, 0xab, 0xc7, 0x79, 0xbe, 0x52, 0x50, 0xa6, 0x97, 0xb9, 0xe0, 0x5b, 0x3e, 0xc1,
+	0x05, 0xdf, 0xb1, 0xfb, 0x65, 0x38, 0xe2, 0xc2, 0xa9, 0x89, 0x73, 0x2c, 0x47, 0xbf, 0x63, 0x50,
+	0x68, 0xd3, 0xb1, 0x91, 0xb4, 0x83, 0x7d, 0x2a, 0x1e, 0x9a, 0xc8, 0x8e, 0x64, 0x5d, 0x21, 0xd0,
+	0xd0, 0xb0, 0x91, 0xd4, 0x83, 0x46, 0x83, 0xc7, 0x1a, 0xd6, 0x48, 0xd8, 0xec, 0x20, 0xc7, 0x30,
+	0x8a, 0x56, 0x14, 0xed, 0xc9, 0xf0, 0x42, 0x53, 0x5c, 0x8d, 0xa2, 0x3d, 0xe4, 0x18, 0xb2, 0x01,
+	0x67, 0xc2, 0x28, 0xee, 0x78, 0xed, 0xe0, 0x35, 0x5a, 0xd7, 0x52, 0x64, 0x58, 0xf1, 0x13, 0xf2,
+	0x81, 0x33, 0x9b, 0xfd, 0x24, 0x38, 0xe8, 0x39, 0xa6, 0x7e, 0xdd, 0x98, 0xd6, 0x03, 0x3f, 0xb5,
+	0xb9, 0x41, 0x56, 0xfd, 0xb6, 0xfa, 0x28, 0x70, 0xc0, 0x53, 0xee, 0x7f, 0xf2, 0x0d, 0x6a, 0xc8,
+	0x35, 0x80, 0x47, 0x96, 0xe8, 0x67, 0x15, 0x64, 0xec, 0x18, 0x0a, 0xc2, 0x12, 0xe9, 0x24, 0x0a,
+	0x75, 0x22, 0x3d, 0x3e, 0x34, 0x91, 0xb6, 0xa8, 0xdc, 0xef, 0x8e, 0xc3, 0x13, 0xba, 0x7f, 0x94,
+	0xa6, 0xb7, 0xa3, 0x78, 0x2f, 0x08, 0x9b, 0xfc, 0x5c, 0xe4, 0x9b, 0x0e, 0x4c, 0x0b, 0x45, 0x91,
+	0x17, 0x99, 0xc4, 0x39, 0x80, 0x5f, 0x44, 0xa7, 0x6a, 0x46, 0xd2, 0xe2, 0x8e, 0x25, 0x25, 0x77,
+	0x89, 0xc9, 0x46, 0x61, 0x66, 0x38, 0xe4, 0x35, 0x00, 0x75, 0xc1, 0xba, 0x51, 0xc4, 0x1d, 0x73,
+	0x35, 0x38, 0xa4, 0x0d, 0x13, 0x82, 0xed, 0x68, 0x09, 0x68, 0x49, 0x23, 0x5f, 0x76, 0x60, 0xa2,
+	0x2d, 0x66, 0x45, 0xd4, 0x75, 0x3f, 0x5d, 0xfc, 0xac, 0xd8, 0xf3, 0xa1, 0x37, 0x35, 0x39, 0x13,
+	0x52, 0x38, 0x41, 0x98, 0x0c, 0xc2, 0x66, 0x4c, 0x13, 0x55, 0x72, 0xf8, 0xa0, 0x15, 0x46, 0x2c,
+	0xfa, 0x51, 0x4c, 0x79, 0xd0, 0x10, 0x79, 0xf5, 0x9a, 0xd7, 0xf6, 0x42, 0x9f, 0xc6, 0x6b, 0x82,
+	0xdc, 0xf8, 0x77, 0x09, 0x40, 0xc5, 0xa8, 0xaf, 0xfd, 0x7a, 0xfc, 0x38, 0xed, 0xd7, 0xe7, 0x3e,
+	0x01, 0x73, 0x7d, 0xcb, 0x78, 0x92, 0x7b, 0x62, 0xe7, 0x3e, 0x0a, 0x53, 0x0f, 0x7a, 0xc5, 0xec,
+	0x8f, 0x27, 0x8c, 0x93, 0xde, 0x8c, 0xea, 0xbc, 0xef, 0x38, 0x36, 0xab, 0x29, 0x23, 0xac, 0xa2,
+	0x74, 0xc3, 0xba, 0x8c, 0xab, 0x81, 0x68, 0xcb, 0x63, 0x9a, 0xd9, 0xf5, 0x62, 0x1a, 0x3e, 0x54,
+	0xcd, 0xdc, 0xd2, 0x12, 0xd0, 0x92, 0x46, 0x68, 0xe6, 0xb8, 0x61, 0x65, 0xc4, 0xe3, 0x06, 0x16,
+	0xee, 0x0d, 0x6c, 0x11, 0x7d, 0xd3, 0x81, 0xd9, 0x30, 0xa3, 0xaf, 0xb2, 0xf2, 0xfc, 0x42, 0xe1,
+	0x86, 0x20, 0x2e, 0x5b, 0x64, 0x61, 0x98, 0x13, 0x4e, 0x96, 0xe1, 0x94, 0x5a, 0x81, 0x6c, 0xff,
+	0xaf, 0x4e, 0xce, 0x31, 0x8b, 0xc6, 0x3c, 0xbd, 0x75, 0x81, 0x60, 0x62, 0xd8, 0x05, 0x02, 0xb2,
+	0xa7, 0xef, 0x0a, 0x4d, 0x16, 0x7b, 0x57, 0x08, 0x06, 0xdc, 0x13, 0xba, 0x09, 0x55, 0x3f, 0xa6,
+	0x5e, 0xfa, 0x80, 0xf7, 0x47, 0xf8, 0x27, 0x09, 0x56, 0x14, 0x03, 0x34, 0xbc, 0xdc, 0xaf, 0x97,
+	0xe1, 0xb4, 0x9a, 0x0e, 0x55, 0x92, 0x65, 0x1b, 0x8e, 0x90, 0x6b, 0x22, 0x37, 0xbd, 0xe1, 0x5c,
+	0x55, 0x08, 0x34, 0x34, 0x2c, 0x64, 0x14, 0xd1, 0x5b, 0x92, 0x3f, 0xa2, 0x90, 0x51, 0x21, 0x2a,
+	0x3c, 0xf9, 0xfa, 0xc0, 0xeb, 0x7a, 0x05, 0x1c, 0xc8, 0xf5, 0xd5, 0x93, 0x4f, 0x78, 0x4f, 0xef,
+	0x0d, 0x07, 0x4e, 0xed, 0x65, 0xce, 0x80, 0x95, 0x23, 0x1d, 0xa5, 0x19, 0x24, 0x7b, 0xaa, 0x6c,
+	0x54, 0x30, 0x0b, 0x4f, 0x30, 0x2f, 0xda, 0xfd, 0x6f, 0x07, 0x6c, 0xaf, 0x72, 0xbc, 0x68, 0xc3,
+	0xba, 0xcc, 0x5b, 0xba, 0xff, 0x65, 0x5e, 0x1d, 0x98, 0x94, 0x8f, 0x17, 0x97, 0x8e, 0x9d, 0x20,
+	0x2e, 0x1d, 0x1f, 0x1a, 0xc9, 0xbc, 0x0f, 0xca, 0xbd, 0xa0, 0x2e, 0x43, 0x4b, 0x53, 0x70, 0x5e,
+	0x5b, 0x45, 0x06, 0x77, 0xff, 0x7c, 0xdc, 0x24, 0x91, 0xf2, 0x44, 0xe9, 0xc7, 0xe2, 0xb5, 0x1b,
+	0xba, 0xb7, 0x47, 0xbc, 0xf9, 0x66, 0x5f, 0x6f, 0xcf, 0x2f, 0x9c, 0xfc, 0xb0, 0x50, 0x4c, 0xd0,
+	0xb0, 0xd6, 0x9e, 0xc9, 0x23, 0x4e, 0x0a, 0x6f, 0x41, 0x85, 0x45, 0xdf, 0xbc, 0x0e, 0x54, 0xc9,
+	0x0c, 0xaa, 0x72, 0x55, 0xc2, 0xef, 0x1d, 0x2e, 0x7c, 0xec, 0xe4, 0xc3, 0x52, 0x4f, 0xa3, 0xe6,
+	0x4f, 0x12, 0xa8, 0xb2, 0xdf, 0xfc, 0x50, 0x53, 0xc6, 0xf5, 0x2f, 0x6a, 0x77, 0xa2, 0x10, 0x85,
+	0x9c, 0x98, 0x1a, 0x39, 0x24, 0x84, 0x2a, 0xbf, 0x24, 0xcc, 0x85, 0x8a, 0xf0, 0x7f, 0x4b, 0x1f,
+	0x2f, 0x2a, 0xc4, 0xbd, 0xc3, 0x85, 0xe7, 0x4f, 0x2e, 0x54, 0x3f, 0x8e, 0x46, 0x84, 0xfb, 0x4e,
+	0xd9, 0xe8, 0xae, 0x6c, 0xe9, 0xfa, 0xb1, 0xd0, 0xdd, 0xe7, 0x72, 0xba, 0x7b, 0xa1, 0x4f, 0x77,
+	0x67, 0xcd, 0xa5, 0xda, 0x8c, 0x36, 0x3e, 0xd2, 0x0d, 0xf2, 0xe8, 0x3c, 0x93, 0x87, 0x05, 0xaf,
+	0xf6, 0x82, 0x98, 0x26, 0x5b, 0x71, 0x2f, 0x0c, 0xc2, 0x26, 0xd7, 0xc5, 0x8a, 0x1d, 0x16, 0x64,
+	0xd0, 0x98, 0xa7, 0x77, 0xbf, 0xcd, 0x0f, 0x7a, 0xac, 0xce, 0x08, 0xb6, 0xc4, 0x6d, 0x7e, 0xd5,
+	0x5a, 0x34, 0x63, 0xe9, 0x25, 0x16, 0xf7, 0xab, 0x05, 0x8e, 0xa4, 0x30, 0xb9, 0x2b, 0xae, 0x9e,
+	0x15, 0xd0, 0xce, 0x2b, 0x2f, 0xb1, 0xf1, 0xeb, 0x42, 0xea, 0x46, 0xdb, 0x3d, 0xf3, 0x13, 0x95,
+	0x28, 0xf7, 0x1b, 0x65, 0x38, 0x95, 0xbb, 0x11, 0x4c, 0x3e, 0x0c, 0x15, 0x75, 0xe5, 0x3b, 0x5f,
+	0x2e, 0xd6, 0x9f, 0xaa, 0xd2, 0x14, 0xe4, 0x33, 0x00, 0x75, 0xda, 0x6d, 0x47, 0x07, 0x3c, 0xea,
+	0x18, 0x3b, 0x71, 0xd4, 0xa1, 0xe3, 0xd3, 0x55, 0xcd, 0x05, 0x2d, 0x8e, 0xb2, 0xfd, 0x6c, 0x5c,
+	0xdc, 0xaa, 0xcb, 0xb6, 0x9f, 0x59, 0xcd, 0xec, 0x13, 0x8f, 0xb0, 0x99, 0x3d, 0x80, 0x53, 0x62,
+	0x7c, 0xba, 0x01, 0xe1, 0x01, 0xfa, 0x0c, 0xce, 0x30, 0x5d, 0x5a, 0xcd, 0xb2, 0xc1, 0x3c, 0x5f,
+	0xf7, 0xab, 0x25, 0x16, 0x78, 0x89, 0x99, 0xde, 0x50, 0xd5, 0xda, 0x0f, 0xc0, 0x84, 0xd7, 0x4b,
+	0x5b, 0x51, 0xdf, 0x25, 0xc0, 0x65, 0x0e, 0x45, 0x89, 0x25, 0xeb, 0x30, 0x56, 0xf7, 0x52, 0xf5,
+	0x61, 0xc5, 0x93, 0x0c, 0xce, 0xd4, 0x68, 0xbc, 0x94, 0x22, 0xe7, 0x42, 0x9e, 0x84, 0xb1, 0xd4,
+	0x6b, 0x66, 0x3e, 0x2b, 0xb3, 0xe3, 0x35, 0x13, 0xe4, 0x50, 0x7b, 0x53, 0x19, 0x3b, 0x62, 0x53,
+	0x79, 0xde, 0xfa, 0xd8, 0xa7, 0x75, 0x06, 0xd0, 0xff, 0x8d, 0x4e, 0x1e, 0xb7, 0x67, 0x69, 0xdd,
+	0x9f, 0x81, 0x69, 0xfb, 0x1b, 0x9e, 0xc7, 0x6a, 0x81, 0x76, 0xff, 0x65, 0x0c, 0x66, 0x32, 0x4d,
+	0x2a, 0x19, 0x15, 0x77, 0x8e, 0x54, 0xf1, 0xa7, 0x60, 0xbc, 0x1b, 0xf7, 0x42, 0x2a, 0x7b, 0x8f,
+	0xb4, 0x10, 0x66, 0xf1, 0x14, 0x05, 0x8e, 0xad, 0x4a, 0x3d, 0x3e, 0xc0, 0x5e, 0x28, 0x8b, 0xc5,
+	0x7a, 0x55, 0x56, 0x39, 0x14, 0x25, 0x96, 0x7c, 0x0e, 0xa6, 0x13, 0xee, 0x0a, 0x85, 0x73, 0x90,
+	0x16, 0x73, 0x65, 0xe4, 0xcf, 0x15, 0xc8, 0x2e, 0x2c, 0x9e, 0x76, 0xdb, 0x10, 0xcc, 0x88, 0x23,
+	0x5f, 0x74, 0xec, 0x4f, 0x34, 0x4c, 0x8c, 0x7c, 0xae, 0x91, 0x6f, 0xfe, 0x11, 0xa6, 0x73, 0xff,
+	0x2f, 0x35, 0x74, 0xb5, 0xd9, 0x4e, 0x3e, 0x04, 0xb3, 0x85, 0x01, 0x26, 0xfb, 0x21, 0xa8, 0x76,
+	0xbc, 0x30, 0x68, 0xd0, 0x24, 0x15, 0xdf, 0xdb, 0xad, 0x8a, 0x6c, 0x67, 0x43, 0x01, 0xd1, 0xe0,
+	0xf9, 0xc7, 0xac, 0xf9, 0x5b, 0x89, 0x5c, 0xa5, 0x6a, 0x7d, 0xcc, 0xda, 0x80, 0xd1, 0xa6, 0x71,
+	0xbf, 0xe3, 0xc0, 0xd9, 0x81, 0x33, 0xf1, 0xee, 0xad, 0xff, 0xb9, 0xdf, 0x29, 0xc1, 0x99, 0x01,
+	0xad, 0x5b, 0x64, 0xff, 0xe1, 0x7c, 0xc3, 0x43, 0x36, 0x86, 0xcd, 0x0c, 0xd5, 0x8a, 0x93, 0x6d,
+	0x3b, 0xc6, 0xf5, 0x97, 0x1f, 0x9d, 0xeb, 0x77, 0xff, 0xb0, 0x04, 0xd6, 0x17, 0x66, 0xc8, 0xaf,
+	0xd8, 0x8d, 0x89, 0x4e, 0x21, 0x8d, 0x74, 0x82, 0xb3, 0xee, 0x6a, 0x14, 0xf3, 0x35, 0xa8, 0xc9,
+	0x31, 0xaf, 0xa6, 0xa5, 0xa3, 0xd5, 0x94, 0x04, 0xaa, 0xf7, 0xb3, 0x5c, 0x70, 0xef, 0x67, 0xb5,
+	0xaf, 0xef, 0xf3, 0x1b, 0x8e, 0xd0, 0xae, 0xdc, 0xfb, 0x18, 0x5f, 0xea, 0xdc, 0xc7, 0x97, 0x7e,
+	0x18, 0x2a, 0x09, 0x6d, 0x37, 0x58, 0xf4, 0x26, 0x7d, 0xae, 0x56, 0x85, 0x6d, 0x09, 0x47, 0x4d,
+	0x41, 0x2e, 0x02, 0x78, 0xed, 0x76, 0x74, 0xfb, 0x52, 0xa7, 0x9b, 0x1e, 0x48, 0xef, 0xab, 0xa3,
+	0x8a, 0x65, 0x8d, 0x41, 0x8b, 0xca, 0xfd, 0xa1, 0x23, 0x16, 0x52, 0x06, 0xe1, 0xcf, 0xe5, 0xee,
+	0x55, 0x1c, 0x3f, 0x7e, 0x3d, 0x00, 0xf0, 0xf5, 0xed, 0xba, 0x02, 0xbe, 0x3d, 0x63, 0xae, 0xea,
+	0xd9, 0x5f, 0x46, 0x51, 0x30, 0xb4, 0x84, 0x65, 0x0c, 0xa6, 0x7c, 0x94, 0xc1, 0xb8, 0xff, 0xee,
+	0x40, 0x66, 0x5f, 0x20, 0x1d, 0x18, 0x67, 0x23, 0x38, 0x28, 0xe0, 0x22, 0xa0, 0xcd, 0x97, 0x19,
+	0x93, 0x54, 0x08, 0xfe, 0x13, 0x85, 0x14, 0x12, 0xc8, 0xd8, 0xbb, 0x34, 0xf2, 0x85, 0x53, 0x5b,
+	0x1a, 0x0b, 0xdd, 0xe5, 0x77, 0x4c, 0x75, 0x10, 0xef, 0x3e, 0x07, 0x73, 0x7d, 0x23, 0xe2, 0xad,
+	0xfa, 0x91, 0xba, 0xf7, 0x68, 0x29, 0x1e, 0xbf, 0xee, 0x81, 0x02, 0xc7, 0x62, 0xf7, 0xd3, 0x79,
+	0xf6, 0xe4, 0x77, 0x1c, 0x98, 0x4b, 0xf2, 0xfc, 0x1e, 0xca, 0xac, 0xe9, 0x5a, 0x54, 0x1f, 0x0a,
+	0xfb, 0x47, 0xe0, 0xfe, 0xad, 0x74, 0x46, 0xe2, 0xe3, 0xee, 0x7a, 0x13, 0x71, 0x86, 0x6e, 0x22,
+	0xcc, 0xac, 0xfc, 0x16, 0xad, 0xf7, 0xda, 0x7d, 0x7d, 0x20, 0xdb, 0x12, 0x8e, 0x9a, 0x22, 0xf3,
+	0x01, 0x8c, 0xf2, 0x91, 0x1f, 0xc0, 0x78, 0x16, 0xa6, 0xed, 0x2b, 0xba, 0xbc, 0x28, 0x26, 0x0f,
+	0x01, 0xec, 0xdb, 0xbc, 0x98, 0xa1, 0xca, 0x7d, 0x46, 0x61, 0xfc, 0xc8, 0xcf, 0x28, 0x3c, 0x0d,
+	0x15, 0xf9, 0xb9, 0x74, 0x55, 0x74, 0x15, 0x4d, 0x26, 0x12, 0x86, 0x1a, 0xcb, 0x9c, 0x42, 0xc7,
+	0x0b, 0x7b, 0x5e, 0x9b, 0xcd, 0x90, 0x6c, 0x73, 0xd2, 0x06, 0xb5, 0xa1, 0x31, 0x68, 0x51, 0x31,
+	0x13, 0xc9, 0x5f, 0x4f, 0xcf, 0x34, 0x4b, 0x39, 0x47, 0x36, 0x4b, 0x65, 0xbb, 0x73, 0x4a, 0xc7,
+	0xea, 0xce, 0xb1, 0x1b, 0x67, 0xca, 0xf7, 0x6d, 0x9c, 0x79, 0xbf, 0xb9, 0x1e, 0x27, 0x3a, 0x6c,
+	0xa6, 0x06, 0x5d, 0x8d, 0x23, 0x2e, 0x4c, 0xf8, 0x9e, 0xee, 0x76, 0x9c, 0x16, 0x01, 0xd1, 0xca,
+	0x32, 0x27, 0x92, 0x98, 0xda, 0xe2, 0x5b, 0xef, 0x9c, 0x7f, 0xec, 0x7b, 0xef, 0x9c, 0x7f, 0xec,
+	0xed, 0x77, 0xce, 0x3f, 0xf6, 0x85, 0xbb, 0xe7, 0x9d, 0xb7, 0xee, 0x9e, 0x77, 0xbe, 0x77, 0xf7,
+	0xbc, 0xf3, 0xf6, 0xdd, 0xf3, 0xce, 0xbf, 0xde, 0x3d, 0xef, 0xfc, 0xd6, 0x0f, 0xce, 0x3f, 0xf6,
+	0x72, 0x45, 0xe9, 0xea, 0xff, 0x05, 0x00, 0x00, 0xff, 0xff, 0x68, 0x16, 0xc5, 0x25, 0x0f, 0x68,
+	0x00, 0x00,
 }
 
 func (m *AWSAuthConfig) Marshal() (dAtA []byte, err error) {
@@ -5808,6 +5809,14 @@ func (m *Repository) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	var l int
 	_ = l
 	i--
+	if m.EnableOCI {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x70
+	i--
 	if m.InheritedCreds {
 		dAtA[i] = 1
 	} else {
@@ -8710,6 +8719,7 @@ func (m *Repository) Size() (n int) {
 	l = len(m.Name)
 	n += 1 + l + sovGenerated(uint64(l))
 	n += 2
+	n += 2
 	return n
 }
 
@@ -10235,6 +10245,7 @@ func (this *Repository) String() string {
 		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
 		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
 		`InheritedCreds:` + fmt.Sprintf("%v", this.InheritedCreds) + `,`,
+		`EnableOCI:` + fmt.Sprintf("%v", this.EnableOCI) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -20273,6 +20284,26 @@ func (m *Repository) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.InheritedCreds = bool(v != 0)
+		case 14:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnableOCI", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.EnableOCI = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
diff --git a/pkg/apis/application/v1alpha1/generated.proto b/pkg/apis/application/v1alpha1/generated.proto
index d9cda2164..763651a23 100644
--- a/pkg/apis/application/v1alpha1/generated.proto
+++ b/pkg/apis/application/v1alpha1/generated.proto
@@ -737,6 +737,9 @@ message Repository {
 
   // Whether credentials were inherited from a credential set
   optional bool inheritedCreds = 13;
+
+  // Whether helm-oci support should be enabled for this repo
+  optional bool enableOCI = 14;
 }
 
 // A RepositoryCertificate is either SSH known hosts entry or TLS certificate
diff --git a/pkg/apis/application/v1alpha1/openapi_generated.go b/pkg/apis/application/v1alpha1/openapi_generated.go
index 948065a1b..f10b3b214 100644
--- a/pkg/apis/application/v1alpha1/openapi_generated.go
+++ b/pkg/apis/application/v1alpha1/openapi_generated.go
@@ -2533,6 +2533,13 @@ func schema_pkg_apis_application_v1alpha1_Repository(ref common.ReferenceCallbac
 							Format:      "",
 						},
 					},
+					"enableOCI": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Whether helm-oci support should be enabled for this repo",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
 				},
 				Required: []string{"repo"},
 			},
diff --git a/pkg/apis/application/v1alpha1/types.go b/pkg/apis/application/v1alpha1/types.go
index 99ac23fc1..1ab0983b5 100644
--- a/pkg/apis/application/v1alpha1/types.go
+++ b/pkg/apis/application/v1alpha1/types.go
@@ -166,6 +166,16 @@ func (a *ApplicationSource) IsHelm() bool {
 	return a.Chart != ""
 }
 
+func (a *ApplicationSource) IsHelmOci() bool {
+	if a.Chart == "" {
+		return false
+	}
+	if _, _, ok := helm.IsHelmOci(a.Chart); ok {
+		return true
+	}
+	return false
+}
+
 func (a *ApplicationSource) IsZero() bool {
 	return a == nil ||
 		a.RepoURL == "" &&
@@ -1303,6 +1313,8 @@ type Repository struct {
 	Name string `json:"name,omitempty" protobuf:"bytes,12,opt,name=name"`
 	// Whether credentials were inherited from a credential set
 	InheritedCreds bool `json:"inheritedCreds,omitempty" protobuf:"bytes,13,opt,name=inheritedCreds"`
+	// Whether helm-oci support should be enabled for this repo
+	EnableOCI bool `json:"enableOCI,omitempty" protobuf:"bytes,14,opt,name=enableOCI"`
 }
 
 // IsInsecure returns true if receiver has been configured to skip server verification
diff --git a/reposerver/repository/repository.go b/reposerver/repository/repository.go
index c222c0a39..8b00f9a45 100644
--- a/reposerver/repository/repository.go
+++ b/reposerver/repository/repository.go
@@ -64,7 +64,7 @@ type Service struct {
 	parallelismLimitSemaphore *semaphore.Weighted
 	metricsServer             *metrics.MetricsServer
 	newGitClient              func(rawRepoURL string, creds git.Creds, insecure bool, enableLfs bool) (git.Client, error)
-	newHelmClient             func(repoURL string, creds helm.Creds) helm.Client
+	newHelmClient             func(repoURL string, creds helm.Creds, enableOci bool) helm.Client
 	initConstants             RepoServerInitConstants
 	// now is usually just time.Now, but may be replaced by unit tests for testing purposes
 	now func() time.Time
@@ -90,8 +90,8 @@ func NewService(metricsServer *metrics.MetricsServer, cache *reposervercache.Cac
 		cache:                     cache,
 		metricsServer:             metricsServer,
 		newGitClient:              git.NewClient,
-		newHelmClient: func(repoURL string, creds helm.Creds) helm.Client {
-			return helm.NewClientWithLock(repoURL, creds, sync.NewKeyLock())
+		newHelmClient: func(repoURL string, creds helm.Creds, enableOci bool) helm.Client {
+			return helm.NewClientWithLock(repoURL, creds, sync.NewKeyLock(), enableOci)
 		},
 		initConstants: initConstants,
 		now:           time.Now,
@@ -1189,7 +1189,7 @@ func (s *Service) newClientResolveRevision(repo *v1alpha1.Repository, revision s
 }
 
 func (s *Service) newHelmClientResolveRevision(repo *v1alpha1.Repository, revision string, chart string) (helm.Client, string, error) {
-	helmClient := s.newHelmClient(repo.Repo, repo.GetHelmCreds())
+	helmClient := s.newHelmClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI)
 	if helm.IsVersion(revision) {
 		return helmClient, revision, nil
 	}
@@ -1232,7 +1232,7 @@ func checkoutRevision(gitClient git.Client, revision string) error {
 }
 
 func (s *Service) GetHelmCharts(ctx context.Context, q *apiclient.HelmChartsRequest) (*apiclient.HelmChartsResponse, error) {
-	index, err := s.newHelmClient(q.Repo.Repo, q.Repo.GetHelmCreds()).GetIndex()
+	index, err := s.newHelmClient(q.Repo.Repo, q.Repo.GetHelmCreds(), q.Repo.EnableOCI).GetIndex()
 	if err != nil {
 		return nil, err
 	}
diff --git a/server/application/application.go b/server/application/application.go
index f3fd7ca02..ab436f8e6 100644
--- a/server/application/application.go
+++ b/server/application/application.go
@@ -1268,7 +1268,7 @@ func (s *Server) resolveRevision(ctx context.Context, app *appv1.Application, sy
 		if helm.IsVersion(ambiguousRevision) {
 			return ambiguousRevision, ambiguousRevision, nil
 		}
-		client := helm.NewClient(repo.Repo, repo.GetHelmCreds())
+		client := helm.NewClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI)
 		index, err := client.GetIndex()
 		if err != nil {
 			return "", "", err
diff --git a/server/repository/repository.go b/server/repository/repository.go
index 7672bb8b8..43f0549f9 100644
--- a/server/repository/repository.go
+++ b/server/repository/repository.go
@@ -139,6 +139,7 @@ func (s *Server) ListRepositories(ctx context.Context, q *repositorypkg.RepoQuer
 				Username:  repo.Username,
 				Insecure:  repo.IsInsecure(),
 				EnableLFS: repo.EnableLFS,
+				EnableOCI: repo.EnableOCI,
 			})
 		}
 	}
@@ -344,6 +345,7 @@ func (s *Server) ValidateAccess(ctx context.Context, q *repositorypkg.RepoAccess
 		Insecure:          q.Insecure,
 		TLSClientCertData: q.TlsClientCertData,
 		TLSClientCertKey:  q.TlsClientCertKey,
+		EnableOCI:         q.EnableOci,
 	}
 
 	var repoCreds *appsv1.RepoCreds
diff --git a/server/repository/repository.proto b/server/repository/repository.proto
index ae4e8779c..fc15732a1 100644
--- a/server/repository/repository.proto
+++ b/server/repository/repository.proto
@@ -63,6 +63,8 @@ message RepoAccessQuery {
 	string type = 9;
 	// The name of the repo
 	string name = 10;
+	// Whether helm-oci support should be enabled for this repo
+	bool enableOci = 11;
 }
 
 message RepoResponse {}
diff --git a/ui/src/app/applications/components/application-resource-tree/application-resource-tree.tsx b/ui/src/app/applications/components/application-resource-tree/application-resource-tree.tsx
index 293a4c361..bbb2a331a 100644
--- a/ui/src/app/applications/components/application-resource-tree/application-resource-tree.tsx
+++ b/ui/src/app/applications/components/application-resource-tree/application-resource-tree.tsx
@@ -330,9 +330,10 @@ export const ApplicationResourceTree = (props: ApplicationResourceTreeProps) =>
             nodeByKey.set(treeNodeKey(node), resourceNode);
         });
     const nodes = Array.from(nodeByKey.values());
-    let roots: ResourceTreeNode[] = null;
+    let roots: ResourceTreeNode[] = [];
     const childrenByParentKey = new Map<string, ResourceTreeNode[]>();
     if (props.useNetworkingHierarchy) {
+        // Network view
         const hasParents = new Set<string>();
         const networkNodes = nodes.filter(node => node.networkingInfo);
         networkNodes.forEach(parent => {
@@ -344,27 +345,6 @@ export const ApplicationResourceTree = (props: ApplicationResourceTreeProps) =>
             });
         });
         roots = networkNodes.filter(node => !hasParents.has(treeNodeKey(node)));
-    } else {
-        const managedKeys = new Set(props.app.status.resources.map(nodeKey));
-        nodes.forEach(child => {
-            (child.parentRefs || []).forEach(parent => {
-                const children = childrenByParentKey.get(treeNodeKey(parent)) || [];
-                children.push(child);
-                childrenByParentKey.set(treeNodeKey(parent), children);
-            });
-        });
-        roots = nodes.filter(node => (node.parentRefs || []).length === 0 || managedKeys.has(nodeKey(node))).sort(compareNodes);
-    }
-
-    function processNode(node: ResourceTreeNode, root: ResourceTreeNode, colors?: string[]) {
-        graph.setNode(treeNodeKey(node), {...node, width: NODE_WIDTH, height: NODE_HEIGHT, root});
-        (childrenByParentKey.get(treeNodeKey(node)) || []).sort(compareNodes).forEach(child => {
-            graph.setEdge(treeNodeKey(node), treeNodeKey(child), {colors});
-            processNode(child, root, colors);
-        });
-    }
-
-    if (props.useNetworkingHierarchy) {
         const externalRoots = roots.filter(root => (root.networkingInfo.ingress || []).length > 0).sort(compareNodes);
         const internalRoots = roots.filter(root => (root.networkingInfo.ingress || []).length === 0).sort(compareNodes);
         const colorsBySource = new Map<string, string>();
@@ -413,14 +393,44 @@ export const ApplicationResourceTree = (props: ApplicationResourceTreeProps) =>
             filterGraph(props.app, externalRoots.length > 0 ? EXTERNAL_TRAFFIC_NODE : INTERNAL_TRAFFIC_NODE, graph, props.nodeFilter);
         }
     } else {
-        roots.sort(compareNodes).forEach(node => processNode(node, node));
+        // Tree view
+        const managedKeys = new Set(props.app.status.resources.map(nodeKey));
+        const orphans: ResourceTreeNode[] = [];
+        nodes.forEach(node => {
+            if ((node.parentRefs || []).length === 0 || managedKeys.has(nodeKey(node))) {
+                roots.push(node);
+            } else {
+                orphans.push(node);
+                node.parentRefs.forEach(parent => {
+                    const children = childrenByParentKey.get(treeNodeKey(parent)) || [];
+                    children.push(node);
+                    childrenByParentKey.set(treeNodeKey(parent), children);
+                });
+            }
+        });
+        roots.sort(compareNodes).forEach(node => {
+            processNode(node, node);
+            graph.setEdge(appNodeKey(props.app), treeNodeKey(node));
+        });
+        orphans.sort(compareNodes).forEach(node => {
+            processNode(node, node);
+        });
         graph.setNode(appNodeKey(props.app), {...appNode, width: NODE_WIDTH, height: NODE_HEIGHT});
-        roots.forEach(root => graph.setEdge(appNodeKey(props.app), treeNodeKey(root)));
         if (props.nodeFilter) {
             filterGraph(props.app, appNodeKey(props.app), graph, props.nodeFilter);
         }
     }
 
+    function processNode(node: ResourceTreeNode, root: ResourceTreeNode, colors?: string[]) {
+        graph.setNode(treeNodeKey(node), {...node, width: NODE_WIDTH, height: NODE_HEIGHT, root});
+        (childrenByParentKey.get(treeNodeKey(node)) || []).sort(compareNodes).forEach(child => {
+            if (treeNodeKey(child) === treeNodeKey(root)) {
+                return;
+            }
+            graph.setEdge(treeNodeKey(node), treeNodeKey(child), {colors});
+            processNode(child, root, colors);
+        });
+    }
     dagre.layout(graph);
 
     const edges: {from: string; to: string; lines: Line[]; backgroundImage?: string}[] = [];
diff --git a/util/argo/argo.go b/util/argo/argo.go
index 972762209..683161a8f 100644
--- a/util/argo/argo.go
+++ b/util/argo/argo.go
@@ -13,8 +13,10 @@ import (
 	"google.golang.org/grpc/status"
 	apierr "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/watch"
 
 	"github.com/argoproj/argo-cd/common"
 	argoappv1 "github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1"
@@ -90,13 +92,51 @@ func RefreshApp(appIf v1alpha1.ApplicationInterface, name string, refreshType ar
 	return nil, err
 }
 
-func TestRepoWithKnownType(repo *argoappv1.Repository, isHelm bool) error {
+// WaitForRefresh watches an application until its comparison timestamp is after the refresh timestamp
+// If refresh timestamp is not present, will use current timestamp at time of call
+func WaitForRefresh(ctx context.Context, appIf v1alpha1.ApplicationInterface, name string, timeout *time.Duration) (*argoappv1.Application, error) {
+	var cancel context.CancelFunc
+	if timeout != nil {
+		ctx, cancel = context.WithTimeout(ctx, *timeout)
+		defer cancel()
+	}
+	ch := kube.WatchWithRetry(ctx, func() (i watch.Interface, e error) {
+		fieldSelector := fields.ParseSelectorOrDie(fmt.Sprintf("metadata.name=%s", name))
+		listOpts := metav1.ListOptions{FieldSelector: fieldSelector.String()}
+		return appIf.Watch(ctx, listOpts)
+	})
+	for next := range ch {
+		if next.Error != nil {
+			return nil, next.Error
+		}
+		app, ok := next.Object.(*argoappv1.Application)
+		if !ok {
+			return nil, fmt.Errorf("Application event object failed conversion: %v", next)
+		}
+		annotations := app.GetAnnotations()
+		if annotations == nil {
+			annotations = make(map[string]string)
+		}
+		if _, ok := annotations[common.AnnotationKeyRefresh]; !ok {
+			return app, nil
+		}
+	}
+	return nil, fmt.Errorf("application refresh deadline exceeded")
+}
+
+func TestRepoWithKnownType(repo *argoappv1.Repository, isHelm bool, isHelmOci bool) error {
 	repo = repo.DeepCopy()
 	if isHelm {
 		repo.Type = "helm"
 	} else {
 		repo.Type = "git"
 	}
+
+	if isHelmOci {
+		repo.EnableOCI = true
+	} else {
+		repo.EnableOCI = false
+	}
 	return TestRepo(repo)
 }
 
@@ -106,8 +146,13 @@ func TestRepo(repo *argoappv1.Repository) error {
 			return git.TestRepo(repo.Repo, repo.GetGitCreds(), repo.IsInsecure(), repo.IsLFSEnabled())
 		},
 		"helm": func() error {
-			_, err := helm.NewClient(repo.Repo, repo.GetHelmCreds()).GetIndex()
-			return err
+			if repo.EnableOCI {
+				_, err := helm.NewClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI).TestHelmOCI()
+				return err
+			} else {
+				_, err := helm.NewClient(repo.Repo, repo.GetHelmCreds(), repo.EnableOCI).GetIndex()
+				return err
+			}
 		},
 	}
 	if check, ok := checks[repo.Type]; ok {
@@ -152,7 +197,7 @@ func ValidateRepo(
 	}
 
 	repoAccessible := false
-	err = TestRepoWithKnownType(repo, app.Spec.Source.IsHelm())
+	err = TestRepoWithKnownType(repo, app.Spec.Source.IsHelm(), app.Spec.Source.IsHelmOci())
 	if err != nil {
 		conditions = append(conditions, argoappv1.ApplicationCondition{
 			Type:    argoappv1.ApplicationConditionInvalidSpecError,
diff --git a/util/db/repository.go b/util/db/repository.go
index 59e9c4936..8786f72b2 100644
--- a/util/db/repository.go
+++ b/util/db/repository.go
@@ -66,6 +66,7 @@ func (db *db) CreateRepository(ctx context.Context, r *appsv1.Repository) (*apps
 		InsecureIgnoreHostKey: r.IsInsecure(),
 		Insecure:              r.IsInsecure(),
 		EnableLFS:             r.EnableLFS,
+		EnableOci:             r.EnableOCI,
 	}
 	err = db.updateRepositorySecrets(&repoInfo, r)
 	if err != nil {
@@ -147,6 +148,7 @@ func (db *db) credentialsToRepository(repoInfo settings.Repository) (*appsv1.Rep
 		InsecureIgnoreHostKey: repoInfo.InsecureIgnoreHostKey,
 		Insecure:              repoInfo.Insecure,
 		EnableLFS:             repoInfo.EnableLFS,
+		EnableOCI:             repoInfo.EnableOci,
 	}
 	err := db.unmarshalFromSecretsStr(map[*string]*apiv1.SecretKeySelector{
 		&repo.Username:          repoInfo.UsernameSecret,
diff --git a/util/helm/client.go b/util/helm/client.go
index 9f85c4fe9..a1099c84f 100644
--- a/util/helm/client.go
+++ b/util/helm/client.go
@@ -42,26 +42,29 @@ type Client interface {
 	CleanChartCache(chart string, version *semver.Version) error
 	ExtractChart(chart string, version *semver.Version) (string, io.Closer, error)
 	GetIndex() (*Index, error)
+	TestHelmOCI() (bool, error)
 }
 
-func NewClient(repoURL string, creds Creds) Client {
-	return NewClientWithLock(repoURL, creds, globalLock)
+func NewClient(repoURL string, creds Creds, enableOci bool) Client {
+	return NewClientWithLock(repoURL, creds, globalLock, enableOci)
 }
 
-func NewClientWithLock(repoURL string, creds Creds, repoLock sync.KeyLock) Client {
+func NewClientWithLock(repoURL string, creds Creds, repoLock sync.KeyLock, enableOci bool) Client {
 	return &nativeHelmChart{
-		repoURL:  repoURL,
-		creds:    creds,
-		repoPath: filepath.Join(os.TempDir(), strings.Replace(repoURL, "/", "_", -1)),
-		repoLock: repoLock,
+		repoURL:   repoURL,
+		creds:     creds,
+		repoPath:  filepath.Join(os.TempDir(), strings.Replace(repoURL, "/", "_", -1)),
+		repoLock:  repoLock,
+		enableOci: enableOci,
 	}
 }
 
 type nativeHelmChart struct {
-	repoPath string
-	repoURL  string
-	creds    Creds
-	repoLock sync.KeyLock
+	repoPath  string
+	repoURL   string
+	creds     Creds
+	repoLock  sync.KeyLock
+	enableOci bool
 }
 
 func fileExist(filePath string) (bool, error) {
@@ -106,7 +109,8 @@ func (c *nativeHelmChart) ExtractChart(chart string, version *semver.Version) (s
 	}
 	if !exists {
 		// always use Helm V3 since we don't have chart content to determine correct Helm version
-		helmCmd, err := NewCmdWithVersion(c.repoPath, HelmV3)
+		helmCmd, err := NewCmdWithVersion(c.repoPath, HelmV3, c.enableOci)
+
 		if err != nil {
 			return "", nil, err
 		}
@@ -117,6 +121,16 @@ func (c *nativeHelmChart) ExtractChart(chart string, version *semver.Version) (s
 			return "", nil, err
 		}
 
+		if c.enableOci {
+			_, err = helmCmd.Login(c.repoURL, c.creds)
+			if err != nil {
+				return "", nil, err
+			}
+			defer func() {
+				_, _ = helmCmd.Logout(c.repoURL, c.creds)
+			}()
+		}
+
 		// (1) because `helm fetch` downloads an arbitrary file name, we download to an empty temp directory
 		tempDest, err := ioutil.TempDir("", "helm")
 		if err != nil {
@@ -127,6 +141,14 @@ func (c *nativeHelmChart) ExtractChart(chart string, version *semver.Version) (s
 		if err != nil {
 			return "", nil, err
 		}
+
+		if c.enableOci {
+			_, err = helmCmd.Export(c.repoURL, chart, version.String(), tempDest)
+			if err != nil {
+				return "", nil, err
+			}
+		}
+
 		// (2) then we assume that the only file downloaded into the directory is the tgz file
 		// and we move that to where we want it
 		infos, err := ioutil.ReadDir(tempDest)
@@ -177,6 +199,34 @@ func (c *nativeHelmChart) GetIndex() (*Index, error) {
 	return index, nil
 }
 
+func (c *nativeHelmChart) TestHelmOCI() (bool, error) {
+	start := time.Now()
+
+	tmpDir, err := ioutil.TempDir("", "helm")
+	if err != nil {
+		return false, err
+	}
+	defer func() { _ = os.RemoveAll(tmpDir) }()
+
+	helmCmd, err := NewCmdWithVersion(tmpDir, HelmV3, c.enableOci)
+	if err != nil {
+		return false, err
+	}
+	defer helmCmd.Close()
+
+	_, err = helmCmd.Login(c.repoURL, c.creds)
+	if err != nil {
+		return false, err
+	}
+	defer func() {
+		_, _ = helmCmd.Logout(c.repoURL, c.creds)
+	}()
+
+	log.WithFields(log.Fields{"seconds": time.Since(start).Seconds()}).Info("took to test helm oci repository")
+
+	return true, nil
+}
+
 func (c *nativeHelmChart) loadRepoIndex() ([]byte, error) {
 	repoURL, err := url.Parse(c.repoURL)
 	if err != nil {
@@ -253,5 +303,16 @@ func normalizeChartName(chart string) string {
 }
 
 func (c *nativeHelmChart) getChartPath(chart string, version *semver.Version) string {
+	if repoNamespace, chartName, isHelmOci := IsHelmOci(chart); isHelmOci {
+		return path.Join(c.repoPath, fmt.Sprintf("%s-%s-%v.tgz", repoNamespace, normalizeChartName(chartName), version))
+	}
 	return path.Join(c.repoPath, fmt.Sprintf("%s-%v.tgz", normalizeChartName(chart), version))
 }
+
+func IsHelmOci(chart string) (string, string, bool) {
+	chartArray := strings.Split(chart, "/")
+	if len(chartArray) == 2 {
+		return chartArray[0], chartArray[1], true
+	}
+	return "", "", false
+}
diff --git a/util/helm/cmd.go b/util/helm/cmd.go
index 838ff9d46..898070900 100644
--- a/util/helm/cmd.go
+++ b/util/helm/cmd.go
@@ -16,18 +16,19 @@ import (
 // A thin wrapper around the "helm" command, adding logging and error translation.
 type Cmd struct {
 	HelmVer
-	helmHome string
-	WorkDir  string
-	IsLocal  bool
+	helmHome  string
+	WorkDir   string
+	IsLocal   bool
+	IsHelmOci bool
 }
 
 func NewCmd(workDir string, version string) (*Cmd, error) {
 	if version != "" {
 		switch version {
 		case "v2":
-			return NewCmdWithVersion(workDir, HelmV2)
+			return NewCmdWithVersion(workDir, HelmV2, false)
 		case "v3":
-			return NewCmdWithVersion(workDir, HelmV3)
+			return NewCmdWithVersion(workDir, HelmV3, false)
 		}
 	}
 	helmVersion, err := getHelmVersion(workDir)
@@ -35,15 +36,15 @@ func NewCmd(workDir string, version string) (*Cmd, error) {
 		return nil, err
 	}
 
-	return NewCmdWithVersion(workDir, *helmVersion)
+	return NewCmdWithVersion(workDir, *helmVersion, false)
 }
 
-func NewCmdWithVersion(workDir string, version HelmVer) (*Cmd, error) {
+func NewCmdWithVersion(workDir string, version HelmVer, isHelmOci bool) (*Cmd, error) {
 	tmpDir, err := ioutil.TempDir("", "helm")
 	if err != nil {
 		return nil, err
 	}
-	return &Cmd{WorkDir: workDir, helmHome: tmpDir, HelmVer: version}, err
+	return &Cmd{WorkDir: workDir, helmHome: tmpDir, HelmVer: version, IsHelmOci: isHelmOci}, err
 }
 
 var redactor = func(text string) string {
@@ -61,6 +62,10 @@ func (c Cmd) run(args ...string) (string, error) {
 			fmt.Sprintf("XDG_DATA_HOME=%s/data", c.helmHome),
 			fmt.Sprintf("HELM_HOME=%s", c.helmHome))
 	}
+
+	if c.IsHelmOci {
+		cmd.Env = append(cmd.Env, "HELM_EXPERIMENTAL_OCI=1")
+	}
 	return executil.RunWithRedactor(cmd, redactor)
 }
 
@@ -71,6 +76,71 @@ func (c *Cmd) Init() (string, error) {
 	return "", nil
 }
 
+func (c *Cmd) Login(repo string, creds Creds) (string, error) {
+	args := []string{"registry", "login"}
+	args = append(args, repo)
+
+	if creds.Username != "" {
+		args = append(args, "--username", creds.Username)
+	}
+
+	if creds.Password != "" {
+		args = append(args, "--password", creds.Password)
+	}
+
+	if creds.CAPath != "" {
+		args = append(args, "--ca-file", creds.CAPath)
+	}
+	if len(creds.CertData) > 0 {
+		filePath, closer, err := writeToTmp(creds.CertData)
+		if err != nil {
+			return "", err
+		}
+		defer io.Close(closer)
+		args = append(args, "--cert-file", filePath)
+	}
+	if len(creds.KeyData) > 0 {
+		filePath, closer, err := writeToTmp(creds.KeyData)
+		if err != nil {
+			return "", err
+		}
+		defer io.Close(closer)
+		args = append(args, "--key-file", filePath)
+	}
+
+	if creds.InsecureSkipVerify {
+		args = append(args, "--insecure")
+	}
+	return c.run(args...)
+}
+
+func (c *Cmd) Logout(repo string, creds Creds) (string, error) {
+	args := []string{"registry", "logout"}
+	args = append(args, repo)
+
+	if creds.CAPath != "" {
+		args = append(args, "--ca-file", creds.CAPath)
+	}
+	if len(creds.CertData) > 0 {
+		filePath, closer, err := writeToTmp(creds.CertData)
+		if err != nil {
+			return "", err
+		}
+		defer io.Close(closer)
+		args = append(args, "--cert-file", filePath)
+	}
+	if len(creds.KeyData) > 0 {
+		filePath, closer, err := writeToTmp(creds.KeyData)
+		if err != nil {
+			return "", err
+		}
+		defer io.Close(closer)
+		args = append(args, "--key-file", filePath)
+	}
+
+	return c.run(args...)
+}
+
 func (c *Cmd) RepoAdd(name string, url string, opts Creds) (string, error) {
 	tmp, err := ioutil.TempDir("", "helm")
 	if err != nil {
@@ -141,17 +211,27 @@ func writeToTmp(data []byte) (string, io.Closer, error) {
 }
 
 func (c *Cmd) Fetch(repo, chartName, version, destination string, creds Creds) (string, error) {
-	args := []string{c.pullCommand, "--destination", destination}
+	args := []string{}
+
+	if _, _, isHelmOci := IsHelmOci(chartName); isHelmOci {
+		args = append(args, "chart", "pull")
+		repoUrl := fmt.Sprintf(repo + "/" + chartName + ":" + version)
+		args = append(args, repoUrl)
+	} else {
+		args = append(args, c.pullCommand, "--destination", destination)
+		if version != "" {
+			args = append(args, "--version", version)
+		}
+		if creds.Username != "" {
+			args = append(args, "--username", creds.Username)
+		}
+		if creds.Password != "" {
+			args = append(args, "--password", creds.Password)
+		}
 
-	if version != "" {
-		args = append(args, "--version", version)
-	}
-	if creds.Username != "" {
-		args = append(args, "--username", creds.Username)
-	}
-	if creds.Password != "" {
-		args = append(args, "--password", creds.Password)
+		args = append(args, "--repo", repo, chartName)
 	}
+
 	if creds.CAPath != "" {
 		args = append(args, "--ca-file", creds.CAPath)
 	}
@@ -172,10 +252,34 @@ func (c *Cmd) Fetch(repo, chartName, version, destination string, creds Creds) (
 		args = append(args, "--key-file", filePath)
 	}
 
-	args = append(args, "--repo", repo, chartName)
 	return c.run(args...)
 }
 
+func (c *Cmd) Export(repo, chartName, version, destination string) (string, error) {
+	output := ""
+	var err error
+	args := []string{"chart", "export"}
+	repoUrl := fmt.Sprintf(repo + "/" + chartName + ":" + version)
+	args = append(args, repoUrl, "--destination", destination)
+
+	output, err = c.run(args...)
+	if err != nil {
+		return "", err
+	}
+
+	// tar helm chart
+	repoNamespace, repoName, _ := IsHelmOci(chartName)
+	cmd := exec.Command("tar", "-zcvf", repoNamespace+"-"+repoName+"-"+version+".tgz", repoName)
+	cmd.Dir = destination
+	_, err = executil.Run(cmd)
+	if err != nil {
+		return "", err
+	}
+	defer func() { _ = os.RemoveAll(destination + "/" + repoName) }()
+
+	return output, nil
+}
+
 func (c *Cmd) dependencyBuild() (string, error) {
 	return c.run("dependency", "build")
 }
diff --git a/util/helm/mocks/Client.go b/util/helm/mocks/Client.go
index c0f2d7e6a..2683c400a 100644
--- a/util/helm/mocks/Client.go
+++ b/util/helm/mocks/Client.go
@@ -83,3 +83,26 @@ func (_m *Client) GetIndex() (*helm.Index, error) {
 
 	return r0, r1
 }
+
+// TestHelmOCI provides a mock function with given fields:
+func (_m *Client) TestHelmOCI() (bool, error) {
+	ret := _m.Called()
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func() bool); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(bool)
+		}
+	}
+
+	var r1 error
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
diff --git a/util/settings/settings.go b/util/settings/settings.go
index 7c9b487d2..22423a32a 100644
--- a/util/settings/settings.go
+++ b/util/settings/settings.go
@@ -166,6 +166,8 @@ type Repository struct {
 	TLSClientCertDataSecret *apiv1.SecretKeySelector `json:"tlsClientCertDataSecret,omitempty"`
 	// Name of the secret storing the TLS client cert's key data
 	TLSClientCertKeySecret *apiv1.SecretKeySelector `json:"tlsClientCertKeySecret,omitempty"`
+	// Whether the repo is helm-oci enabled. Git only.
+	EnableOci bool `json:"enableOci,omitempty"`
 }
 
 // Credential template for accessing repositories


Test patch:
diff --git a/cmd/argocd-util/commands/project_allowlist_test.go b/cmd/argocd-util/commands/project_allowlist_test.go
new file mode 100644
index 000000000..ab81f8e61
--- /dev/null
+++ b/cmd/argocd-util/commands/project_allowlist_test.go
@@ -0,0 +1,57 @@
+package commands
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/undefinedlabs/go-mpatch"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/discovery"
+	restclient "k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+func TestProjectAllowListGen(t *testing.T) {
+	useMock := true
+	rules := clientcmd.NewDefaultClientConfigLoadingRules()
+	overrides := &clientcmd.ConfigOverrides{}
+	clientConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(rules, overrides)
+
+	if useMock {
+		var patchClientConfig *mpatch.Patch
+		patchClientConfig, err := mpatch.PatchInstanceMethodByName(reflect.TypeOf(clientConfig), "ClientConfig", func(*clientcmd.DeferredLoadingClientConfig) (*restclient.Config, error) {
+			return nil, nil
+		})
+		assert.NoError(t, err)
+
+		patch, err := mpatch.PatchMethod(discovery.NewDiscoveryClientForConfig, func(c *restclient.Config) (*discovery.DiscoveryClient, error) {
+			return &discovery.DiscoveryClient{LegacyPrefix: "/api"}, nil
+		})
+		assert.NoError(t, err)
+
+		var patchSeverPreferedResources *mpatch.Patch
+		discoClient := &discovery.DiscoveryClient{}
+		patchSeverPreferedResources, err = mpatch.PatchInstanceMethodByName(reflect.TypeOf(discoClient), "ServerPreferredResources", func(*discovery.DiscoveryClient) ([]*metav1.APIResourceList, error) {
+			res := metav1.APIResource{
+				Name: "services",
+				Kind: "Service",
+			}
+			resourceList := []*metav1.APIResourceList{{APIResources: []metav1.APIResource{res}}}
+			return resourceList, nil
+		})
+		assert.NoError(t, err)
+
+		defer func() {
+			err = patchClientConfig.Unpatch()
+			assert.NoError(t, err)
+			err = patch.Unpatch()
+			assert.NoError(t, err)
+			err = patchSeverPreferedResources.Unpatch()
+			err = patch.Unpatch()
+		}()
+	}
+
+	globalProj := generateProjectAllowList(clientConfig, "testdata/test_clusterrole.yaml", "testproj")
+	assert.True(t, len(globalProj.Spec.NamespaceResourceWhitelist) > 0)
+}
diff --git a/cmd/argocd-util/commands/testdata/test_clusterrole.yaml b/cmd/argocd-util/commands/testdata/test_clusterrole.yaml
new file mode 100644
index 000000000..bce7b0fd2
--- /dev/null
+++ b/cmd/argocd-util/commands/testdata/test_clusterrole.yaml
@@ -0,0 +1,787 @@
+aggregationRule:
+  clusterRoleSelectors:
+    - matchLabels:
+        rbac.authorization.k8s.io/aggregate-to-admin: "true"
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    kubernetes.io/bootstrapping: rbac-defaults
+  name: admin
+rules:
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - workflows
+      - workflows/finalizers
+      - workflowtemplates
+      - workflowtemplates/finalizers
+      - cronworkflows
+      - cronworkflows/finalizers
+      - clusterworkflowtemplates
+      - clusterworkflowtemplates/finalizers
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - gateways
+      - gateways/finalizers
+      - sensors
+      - sensors/finalizers
+      - eventsources
+      - eventsources/finalizers
+      - eventbuses
+      - eventbuses/finalizers
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - rollouts
+      - rollouts/scale
+      - experiments
+      - analysistemplates
+      - clusteranalysistemplates
+      - analysisruns
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - iammanager.keikoproj.io
+    resources:
+      - iamroles
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods/attach
+      - pods/exec
+      - pods/portforward
+      - pods/proxy
+      - secrets
+      - services/proxy
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccounts
+    verbs:
+      - impersonate
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/attach
+      - pods/exec
+      - pods/portforward
+      - pods/proxy
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - endpoints
+      - persistentvolumeclaims
+      - replicationcontrollers
+      - replicationcontrollers/scale
+      - secrets
+      - serviceaccounts
+      - services
+      - services/proxy
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update
+  - apiGroups:
+      - apps
+    resources:
+      - daemonsets
+      - deployments
+      - deployments/rollback
+      - deployments/scale
+      - replicasets
+      - replicasets/scale
+      - statefulsets
+      - statefulsets/scale
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update
+  - apiGroups:
+      - autoscaling
+    resources:
+      - horizontalpodautoscalers
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update
+  - apiGroups:
+      - batch
+    resources:
+      - cronjobs
+      - jobs
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update
+  - apiGroups:
+      - extensions
+    resources:
+      - daemonsets
+      - deployments
+      - deployments/rollback
+      - deployments/scale
+      - ingresses
+      - networkpolicies
+      - replicasets
+      - replicasets/scale
+      - replicationcontrollers/scale
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update
+  - apiGroups:
+      - policy
+    resources:
+      - poddisruptionbudgets
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - networkpolicies
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - create
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - delete
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - deletecollection
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - patch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - update
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - workflows
+      - workflows/finalizers
+      - workflowtemplates
+      - workflowtemplates/finalizers
+      - cronworkflows
+      - cronworkflows/finalizers
+      - clusterworkflowtemplates
+      - clusterworkflowtemplates/finalizers
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - gateways
+      - gateways/finalizers
+      - sensors
+      - sensors/finalizers
+      - eventsources
+      - eventsources/finalizers
+      - eventbuses
+      - eventbuses/finalizers
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - rollouts
+      - rollouts/scale
+      - experiments
+      - analysistemplates
+      - clusteranalysistemplates
+      - analysisruns
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resourceNames:
+      - prometheus-k8s-prometheus-1
+      - prometheus-k8s-prometheus-0
+    resources:
+      - pods/portforward
+    verbs:
+      - create
+  - apiGroups:
+      - networking.istio.io
+    resources:
+      - virtualservices
+      - destinationrules
+      - serviceentries
+      - envoyfilters
+      - gateways
+      - sidecars
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - endpoints
+      - persistentvolumeclaims
+      - pods
+      - replicationcontrollers
+      - replicationcontrollers/scale
+      - serviceaccounts
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - bindings
+      - events
+      - limitranges
+      - namespaces/status
+      - pods/log
+      - pods/status
+      - replicationcontrollers/status
+      - resourcequotas
+      - resourcequotas/status
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - daemonsets
+      - deployments
+      - deployments/scale
+      - replicasets
+      - replicasets/scale
+      - statefulsets
+      - statefulsets/scale
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - autoscaling
+    resources:
+      - horizontalpodautoscalers
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - batch
+    resources:
+      - cronjobs
+      - jobs
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - daemonsets
+      - deployments
+      - deployments/scale
+      - ingresses
+      - networkpolicies
+      - replicasets
+      - replicasets/scale
+      - replicationcontrollers/scale
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - policy
+    resources:
+      - poddisruptionbudgets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - networkpolicies
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - controllerrevisions
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - controllerrevisions
+    verbs:
+      - list
+  - apiGroups:
+      - apps
+    resources:
+      - controllerrevisions
+    verbs:
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - list
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - persistentvolumeclaims/status
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - persistentvolumeclaims/status
+    verbs:
+      - list
+  - apiGroups:
+      - ""
+    resources:
+      - persistentvolumeclaims/status
+    verbs:
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - services/status
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - services/status
+    verbs:
+      - list
+  - apiGroups:
+      - ""
+    resources:
+      - services/status
+    verbs:
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - daemonsets/status
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - daemonsets/status
+    verbs:
+      - list
+  - apiGroups:
+      - apps
+    resources:
+      - daemonsets/status
+    verbs:
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - deployments/status
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - deployments/status
+    verbs:
+      - list
+  - apiGroups:
+      - apps
+    resources:
+      - deployments/status
+    verbs:
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets/status
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets/status
+    verbs:
+      - list
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets/status
+    verbs:
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - statefulsets/status
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - statefulsets/status
+    verbs:
+      - list
+  - apiGroups:
+      - apps
+    resources:
+      - statefulsets/status
+    verbs:
+      - watch
+  - apiGroups:
+      - autoscaling
+    resources:
+      - horizontalpodautoscalers/status
+    verbs:
+      - get
+  - apiGroups:
+      - autoscaling
+    resources:
+      - horizontalpodautoscalers/status
+    verbs:
+      - list
+  - apiGroups:
+      - autoscaling
+    resources:
+      - horizontalpodautoscalers/status
+    verbs:
+      - watch
+  - apiGroups:
+      - batch
+    resources:
+      - cronjobs/status
+    verbs:
+      - get
+  - apiGroups:
+      - batch
+    resources:
+      - cronjobs/status
+    verbs:
+      - list
+  - apiGroups:
+      - batch
+    resources:
+      - cronjobs/status
+    verbs:
+      - watch
+  - apiGroups:
+      - batch
+    resources:
+      - jobs/status
+    verbs:
+      - get
+  - apiGroups:
+      - batch
+    resources:
+      - jobs/status
+    verbs:
+      - list
+  - apiGroups:
+      - batch
+    resources:
+      - jobs/status
+    verbs:
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - daemonsets/status
+    verbs:
+      - get
+  - apiGroups:
+      - extensions
+    resources:
+      - daemonsets/status
+    verbs:
+      - list
+  - apiGroups:
+      - extensions
+    resources:
+      - daemonsets/status
+    verbs:
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - deployments/status
+    verbs:
+      - get
+  - apiGroups:
+      - extensions
+    resources:
+      - deployments/status
+    verbs:
+      - list
+  - apiGroups:
+      - extensions
+    resources:
+      - deployments/status
+    verbs:
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses/status
+    verbs:
+      - get
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses/status
+    verbs:
+      - list
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses/status
+    verbs:
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - replicasets/status
+    verbs:
+      - get
+  - apiGroups:
+      - extensions
+    resources:
+      - replicasets/status
+    verbs:
+      - list
+  - apiGroups:
+      - extensions
+    resources:
+      - replicasets/status
+    verbs:
+      - watch
+  - apiGroups:
+      - policy
+    resources:
+      - poddisruptionbudgets/status
+    verbs:
+      - get
+  - apiGroups:
+      - policy
+    resources:
+      - poddisruptionbudgets/status
+    verbs:
+      - list
+  - apiGroups:
+      - policy
+    resources:
+      - poddisruptionbudgets/status
+    verbs:
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - get
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - list
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - prometheusrules
+    verbs:
+      - get
+      - watch
+      - list
+      - update
+      - delete
+      - create
+  - apiGroups:
+      - hpa.orkaproj.io
+    resources:
+      - hpaalgoes
+    verbs:
+      - get
+      - watch
+      - list
+      - update
+      - delete
+      - create
+  - apiGroups:
+      - networking.istio.io
+    resources:
+      - virtualservices
+      - destinationrules
+      - serviceentries
+      - envoyfilters
+      - gateways
+      - sidecars
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+      - patch
+      - watch
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - localsubjectaccessreviews
+    verbs:
+      - create
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - rolebindings
+      - roles
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - get
+      - list
+      - patch
+      - update
+      - watch
diff --git a/reposerver/repository/repository_test.go b/reposerver/repository/repository_test.go
index 4792c8993..e9b95e5fc 100644
--- a/reposerver/repository/repository_test.go
+++ b/reposerver/repository/repository_test.go
@@ -86,7 +86,7 @@ func newServiceWithOpt(cf clientFunc) (*Service, *gitmocks.Client) {
 	service.newGitClient = func(rawRepoURL string, creds git.Creds, insecure bool, enableLfs bool) (client git.Client, e error) {
 		return gitClient, nil
 	}
-	service.newHelmClient = func(repoURL string, creds helm.Creds) helm.Client {
+	service.newHelmClient = func(repoURL string, creds helm.Creds, enableOci bool) helm.Client {
 		return helmClient
 	}
 	return service, gitClient
diff --git a/util/helm/client_test.go b/util/helm/client_test.go
index 248df2487..44e87cb1f 100644
--- a/util/helm/client_test.go
+++ b/util/helm/client_test.go
@@ -12,12 +12,12 @@ import (
 
 func TestIndex(t *testing.T) {
 	t.Run("Invalid", func(t *testing.T) {
-		client := NewClient("", Creds{})
+		client := NewClient("", Creds{}, false)
 		_, err := client.GetIndex()
 		assert.Error(t, err)
 	})
 	t.Run("Stable", func(t *testing.T) {
-		client := NewClient("https://argoproj.github.io/argo-helm", Creds{})
+		client := NewClient("https://argoproj.github.io/argo-helm", Creds{}, false)
 		index, err := client.GetIndex()
 		assert.NoError(t, err)
 		assert.NotNil(t, index)
@@ -26,7 +26,7 @@ func TestIndex(t *testing.T) {
 		client := NewClient("https://argoproj.github.io/argo-helm", Creds{
 			Username: "my-password",
 			Password: "my-username",
-		})
+		}, false)
 		index, err := client.GetIndex()
 		assert.NoError(t, err)
 		assert.NotNil(t, index)
@@ -34,7 +34,7 @@ func TestIndex(t *testing.T) {
 }
 
 func Test_nativeHelmChart_ExtractChart(t *testing.T) {
-	client := NewClient("https://argoproj.github.io/argo-helm", Creds{})
+	client := NewClient("https://argoproj.github.io/argo-helm", Creds{}, false)
 	path, closer, err := client.ExtractChart("argo-cd", semver.MustParse("0.7.1"))
 	assert.NoError(t, err)
 	defer io.Close(closer)
diff --git a/util/helm/cmd_test.go b/util/helm/cmd_test.go
index 8ed6af23b..71aa6a6c3 100644
--- a/util/helm/cmd_test.go
+++ b/util/helm/cmd_test.go
@@ -13,7 +13,7 @@ func Test_cmd_redactor(t *testing.T) {
 }
 
 func TestCmd_template_kubeVersion(t *testing.T) {
-	cmd, err := NewCmdWithVersion(".", HelmV3)
+	cmd, err := NewCmdWithVersion(".", HelmV3, false)
 	assert.NoError(t, err)
 	s, err := cmd.template("testdata/redis", &TemplateOpts{
 		KubeVersion: "1.14",