diff --git a/charts/all/tempostack/templates/minio.yaml b/charts/all/tempostack/templates/minio.yaml
index 7ef2af84..1a1982c9 100644
--- a/charts/all/tempostack/templates/minio.yaml
+++ b/charts/all/tempostack/templates/minio.yaml
@@ -88,7 +88,7 @@ spec:
   selector:
     app: {{ include "tempostack.fullname" . }}
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: {{ .Values.tempostack.storage.secretName }}
diff --git a/charts/all/travelops/mysqldb/templates/externalSecret.yaml b/charts/all/travelops/mysqldb/templates/externalSecret.yaml
index 73fc730e..6d17f63c 100644
--- a/charts/all/travelops/mysqldb/templates/externalSecret.yaml
+++ b/charts/all/travelops/mysqldb/templates/externalSecret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: "external-secrets.io/v1beta1"
+apiVersion: "external-secrets.io/v1"
 kind: ExternalSecret
 metadata:
   name: mysqldb-credentials-external-secret
diff --git a/charts/all/travelops/travel-control/templates/_helpers.tpl b/charts/all/travelops/travel-control/templates/_helpers.tpl
index 83daca9f..5d87faac 100644
--- a/charts/all/travelops/travel-control/templates/_helpers.tpl
+++ b/charts/all/travelops/travel-control/templates/_helpers.tpl
@@ -102,3 +102,45 @@ for apps in control; do
   echo "✅ ${apps} in ${NS} is fully rolled out with sidecars."
 done
 {{- end }}
+
+{{- define "travel-control.consoleLink" }}
+#!/bin/bash
+set -euo pipefail
+
+GATEWAY_NS={{ .Values.gateway.namespace | default "travel-control" | quote }}
+ROUTE_NAME="travel-control"
+CONSOLE_LINK_NAME="travel-console-link"
+IMAGE_URL={{ .Values.consoleLink.imageURL | quote }}
+
+for i in $(seq 1 60); do
+  HOST=$(oc get route "${ROUTE_NAME}" -n "${GATEWAY_NS}" -o jsonpath='{.spec.host}' 2>/dev/null || true)
+  if [[ -n "${HOST}" ]]; then
+    break
+  fi
+  echo "Waiting for route host..."
+  sleep 5
+done
+
+if [[ -z "${HOST}" ]]; then
+  echo "ERROR: Route host not available"
+  exit 1
+fi
+
+HREF="https://${HOST}"
+
+oc apply -f - <<EOF
+apiVersion: console.openshift.io/v1
+kind: ConsoleLink
+metadata:
+  name: ${CONSOLE_LINK_NAME}
+spec:
+  href: "${HREF}"
+  location: ApplicationMenu
+  text: Travel Portal
+  applicationMenu:
+    section: Travelops
+    imageURL: "${IMAGE_URL}"
+EOF
+
+echo "ConsoleLink updated with href=${HREF}"
+{{- end }}
diff --git a/charts/all/travelops/travel-control/templates/clusterrole-console-link.yaml b/charts/all/travelops/travel-control/templates/clusterrole-console-link.yaml
new file mode 100644
index 00000000..e3121cc1
--- /dev/null
+++ b/charts/all/travelops/travel-control/templates/clusterrole-console-link.yaml
@@ -0,0 +1,23 @@
+{{- if .Values.gateway.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: travelops-console-link
+rules:
+- apiGroups:
+  - route.openshift.io
+  resources:
+  - routes
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - console.openshift.io
+  resources:
+  - consolelinks
+  verbs:
+  - get
+  - create
+  - update
+  - patch
+{{- end }}
diff --git a/charts/all/travelops/travel-control/templates/clusterrolebinding-console-link.yaml b/charts/all/travelops/travel-control/templates/clusterrolebinding-console-link.yaml
new file mode 100644
index 00000000..58a8b95f
--- /dev/null
+++ b/charts/all/travelops/travel-control/templates/clusterrolebinding-console-link.yaml
@@ -0,0 +1,14 @@
+{{- if .Values.gateway.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: travelops-console-link
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: travelops-console-link
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.rbac.serviceAccountName }}
+  namespace: travel-control
+{{- end }}
diff --git a/charts/all/travelops/travel-control/templates/cm-console-link.yaml b/charts/all/travelops/travel-control/templates/cm-console-link.yaml
new file mode 100644
index 00000000..dcbee37e
--- /dev/null
+++ b/charts/all/travelops/travel-control/templates/cm-console-link.yaml
@@ -0,0 +1,10 @@
+{{- if .Values.gateway.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: console-link
+  namespace: travel-control
+data:
+  console-link.sh: |
+{{- include "travel-control.consoleLink" . | indent 4 }}
+{{- end }}
diff --git a/charts/all/travelops/travel-control/templates/job-console-link.yaml b/charts/all/travelops/travel-control/templates/job-console-link.yaml
new file mode 100644
index 00000000..239c94e7
--- /dev/null
+++ b/charts/all/travelops/travel-control/templates/job-console-link.yaml
@@ -0,0 +1,33 @@
+{{- if .Values.gateway.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+  name: console-link
+  namespace: travel-control
+spec:
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+    spec:
+      containers:
+      - image: {{ .Values.job.image }}
+        name: console-link
+        command:
+          - /bin/bash
+          - /usr/local/bin/console-link.sh
+        volumeMounts:
+        - mountPath: /usr/local/bin/console-link.sh
+          name: console-link
+          subPath: console-link.sh
+      volumes:
+        - name: console-link
+          configMap:
+            name: console-link
+      dnsPolicy: ClusterFirst
+      restartPolicy: Never
+      serviceAccount: {{ .Values.rbac.serviceAccountName }}
+      terminationGracePeriodSeconds: 400
+{{- end }}
diff --git a/charts/all/travelops/travel-control/templates/route.yaml b/charts/all/travelops/travel-control/templates/route.yaml
new file mode 100644
index 00000000..5067b562
--- /dev/null
+++ b/charts/all/travelops/travel-control/templates/route.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.gateway.enabled }}
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: travel-control
+  namespace: travel-control
+  labels:
+    {{- include "travel-control.labels" . | nindent 4 }}
+spec:
+  to:
+    kind: Service
+    name: travel-control-gateway-istio
+    weight: 100
+  port:
+    targetPort: 80
+  tls:
+    termination: edge
+    insecureEdgeTerminationPolicy: Redirect
+{{- end }}
diff --git a/charts/all/travelops/travel-control/values.yaml b/charts/all/travelops/travel-control/values.yaml
index 03a70452..2c49a536 100644
--- a/charts/all/travelops/travel-control/values.yaml
+++ b/charts/all/travelops/travel-control/values.yaml
@@ -33,3 +33,6 @@ gateway:
   path: "/"
   allowedRoutes:
     from: Same
+
+consoleLink:
+  imageURL: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYEAYAAACw5+G7AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAAAAAAAAPlDu38AAAAJcEhZcwAAAGAAAABgAPBrQs8AAAAHdElNRQfqBhASHwRxx43iAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDI2LTA2LTE2VDE4OjMxOjA0KzAwOjAwcuWO8QAAACV0RVh0ZGF0ZTptb2RpZnkAMjAyNi0wNi0xNlQxODozMTowNCswMDowMAO4Nk0AAAAodEVYdGRhdGU6dGltZXN0YW1wADIwMjYtMDYtMTZUMTg6MzE6MDQrMDA6MDBUrReSAAAKHElEQVRYw9WXZ3SWVRLHf/M8b0l505ESiCRAAgSQXqSmUGMokeKCIJFIEylSwlIUVhBQ0FV6UYqQ6AJHF9CoSCAQMLRIWUINTVIhgUACKe/7Pnc/bAQ8i7ueXT1ndz7dc8+dmf/c+d+ZO/B/LvL7mW7ydRgAarNRDcA0zvIMgDaQEgBVohoDUJPXAEg2KQD3CzeHAdwuqNcA4OzAbdt+2Yv22wFu2bJlSwRaDmkeBXTRPfQjIM9bDltjACpMxhxeB25QZu4AKktFW3oB92ilZUqWqrC3BXn+vtWvBaCZMouWAjyzuNspLL/k1fTfA28aGVGCK9i3q5qUShOtsaUPqP1MdQT6DsLN2G9MDj3OX61h2twmtbii3sSjdncqZJ40sF7Eh6fE7+YKpcsS7d6ZYqmFO6kZXhhFs1zjriINfAeVeqsKmdbib11fwcOIc3wj4ymG09O+a/ozCq1Zc2ENwOmGdQcCNOp5bSaAEShmALWVeABsHAPgqvQHqm0f8MZSIP9OcG6BZQQ3NA3XiEaUkiB1YvdJN+kjw9uIylAnaF0whFQc2LKnYAF+LD8uPeVpqLKDUKpSPUijiDZ45n+AxhG8tpuJU9vk9JYVslOLVw1udjKuOtsYNYBb8qax5GcUOvV0yCiA+nOulwHsbl93FQDdSHePAHzRfKsAXuT7vgf6btNk2wHyfd0D5rsbLJMkmT82iGqmFJdDqxIIrrezbWSnNDX6WefgI4fGkOJJ1Wde3kkv+2flMSMLiSSYzLHD8Fa71L7YQFzULrVsiK/6lgy1eP8ybPQga3RnEmSucl921ljCPDlcN14L067or4CWLEmW83gKLG99eQj+QAhCDhgbSPBbANowpveoD2ol9fo2AE7TPbQI0Dhn6gqySuxnlzAp+eTqwOwxzMv1unBo4F3mtajbt7++k7UhWzo2d79NkXm4ZcrdD0Aza/Xjx8PY9U9HbZkG3cbH3QLxvDXimgOYLSdlOah4c7AM1efLOnumGtL5OokspWThCDLpSXheCvXVs8ascZ+oDdQiP/ucwPKwy7MBuM+FwGJQ4QyanQsE0P7FEYBQ5pIKKBSAZGh9ge63p2dNKVjBlpS9H63RP+T9kHfap5QXsahRw66Lfe4Cr8tmazlwTn0HwB2sJycB3vQb2g9UnJ6fEQ7WNfbrACvXjmoB7Je3tW5AmeiyDqRQ3WR0l2SWyOesWenkFGnqm60jlRM3o/2CHiZgBYd9BoFyMDY+HThK4xEmoJQySa3klxMIkpbowCy18UF/BmceS6ttHyrV3QN8QkpXKs/6AZ37+GwCZkqBdTNwVH1NBSA4sAB2PJqWAWc5EDMFJNiZc74EKgZpPk4bnDqzzxvoQl/SAUeLmMj5oEzFsTW99gdjeBg5nhuHirc6IpOGHxQnufqMXdc14B25HuENnKbri1FAKbp0qOwRJZUB6CBHpCMQUfxNYaIjSeJzos53dd5Wg4Ovtz/gupkic6LrPjcncEJ9WaklWACF4AD8uCOrAVfxig4BqS/RXj2B/dL8SfXRecEtBGSo7XSO8LQEqE+ptWsHLtIWt4qtaq0MITl8pQbKqg5EvQUUUeC5CRAEZ6UZ2yOLckb6E4nlnvfNhVYDq2NT+SKTUOhz3V9z2wrkqO+1RMBO2RPLtaqseTa1o143wFN9WO0scEvNfVJ51o6UmkEl4FT9QGVTX03I2qaSKOfW6YEMxopfx2QNaERxw/SftB7d+CNLD3fdnZPRKr4onXl/PBaXLNsN+x00l3a2ZeXTgGmq0a9qHP7UNf8AnOB89WmAn0x50rETHntiAGV/4PAEU6hfsGerklEEqzSVnpcj/cnmRECEBpSQy4RKLfVvnCtAx4wGagfzAchgD05A/5VtsRyDu6DGcZJEYDSB/9LlPtUAmGC95ToegHyuSQRCNYLUeg2I5ubZn1hrPPZoebhnVIIv1pdiWOJcN7uNoaJ8XEmM2Rtn6eXisdYk4F05+6sCKOCqPQwklRfysoCFavyTjjXdFP4GIJYcc0dwjMmOy1tlS+ESHaVd9RpqO7VpcyNFA9lFq6TNQA30u6sAA/WQQsWP3USo2sZu7J5UXVmeT7lpkvW2Yw9VirxzDt1fANSgmdEBMOPyT2gcj+W3Kg0uZQCtCM03A72IeFIADu4XgQyWThIAUl0KZEvAMumFjmpynM9oRsjBHzVgodTe2xrwkKiEIMAdV/VVZTY8HmVEdVBpQLLN4hds/ka967+/4Rl9pnx6qdP398sa422fWFr4AKClxDwkXEXlygSYcFU9QeLJ+zIQxI/Iu4dBmpH0BPyl5kSPo6ASPUyat3RUN+hP995dqRA/3Cz+MhYHe1Pe1CFq+cQmZX8BuUzs2XBgoPS25QJ36N8wCbiP2dwTuMNoAFmvvWgOp9StildheSPSLs74PsfaD7vqaEQ/CORg1VF1tptLgFjZZAoC8hgKQKi0OukGco7eC78A1UPvl/8qWFydUwHyBp1rA+ytVqPOdOAq4SIgkfYrakDYHhlJqqybNYpsXqLNZ0fVA60v/p8n6BDVbuIk/IFckop2gyjuHdoAXGJWRhrgRpzjNCCEEAn0VN6FQVx23es5/HhNjNxFFzelbmdO5uq0o42fw2F+yRpvb0GG38xasfIHyvQc8/pb/qB10D956wqMWxDUNPnPYB9ashHE7cDiBF+QeUYVAIaZW9FZvyMd1Tb1Uth0EsmUuEV+5HCc1GsedJDdTJm/g1QO4nH3u8d+o+99VLoVwDonbxKAV0VgNkDR/CtH3G2AUwZY8oGX1CBZCHqw6bWKINhzYm1rtZ4Vl4+lZY3YyCjLRJek13dgqp3drIa1kIVVp9XJ2pdIkzPPJ09euJLehbuyBuSPAlNDa5gzRnxkGG/a9lCXHdStWU19IhvxjXHKC3yB3m8uSl0i9MRAtVadNPrM3KctkKr67CvNiGUfP+D5WADLW59bBlCyM+QBgFv5lS8B5Gtt6T8YLV0AiFZvAfAFjYHqn//wp1Igr+hoXoDZST4RRlz4CYrJVRti8yUSH2nVbpI6Q7IqK4zgoDomnbOOY6Ecj4py6QHcr9KYRhLCucAN3AOcea0wqxQ6bYtggozR/BOmysfKbl9xq7aRo+dY3gPyCXR++5uMlM2XdG+OC0gwfpRJiHMoh0Bd1Lc4v/L5TDzVdbGFrlNb0JjUpAeXmUFx4GrK0dRu6yh81W4u5T9LP1nN5DO1ZDFfMTZjnlqswh88dXWMtJZU203aSawx2/48HsY408e2qxRDevqXLX/TmTiMMBDQopQbivAih+kmiKeaIR+C2uEzu8RJL7gd7f6y+SJQS7lJCBhvGHscf5RT+kjLc0YX3lbTjUBQ2zlo5AIGuvhggZOdkkseVrWH8jsO9c07dC0AUO/K+wDaq0Y0gLFdogFwUVMBaK9mAIjuHADgbOs1DgFzZvY0FKSnp6f/5yj+5+XvO4AIw7tLOP8AAAAASUVORK5CYII="
diff --git a/values-hub.yaml b/values-hub.yaml
index b5d1ba9e..fb252292 100644
--- a/values-hub.yaml
+++ b/values-hub.yaml
@@ -3,42 +3,45 @@ clusterGroup:
   isHubCluster: true
 
   namespaces:
-    - vault
-    - golang-external-secrets
-    - travel-agency:
-        labels:
-          istio-discovery: enabled
-          istio.io/rev: default
-    - travel-portal:
-        labels:
-          istio-discovery: enabled
-          istio.io/rev: default
-    - travel-control:
-        labels:
-          istio-discovery: enabled
-          istio.io/rev: default
-    - istio-cni:
-        labels:
-          istio-discovery: enabled
-    - istio-system:
-        labels:
-          istio-discovery: enabled
-    - tempo:
-        labels:
-          istio-discovery: enabled
-    - openshift-tempo-operator:
-        labels:
-          openshift.io/cluster-monitoring: true
-        operatorGroup: true
-        targetNamespaces:
-    - openshift-opentelemetry-operator:
-        operatorGroup: true
-        targetNamespaces:
-    - openshift-cluster-observability-operator:
-        labels:
-          openshift.io/cluster-monitoring: true
-        operatorGroup: true
-        targetNamespaces:
+    vault:
+    external-secrets-operator:
+      operatorGroup: true
+      targetNamespaces: []
+    external-secrets:
+    travel-agency:
+      labels:
+        istio-discovery: enabled
+        istio.io/rev: default
+    travel-portal:
+      labels:
+        istio-discovery: enabled
+        istio.io/rev: default
+    travel-control:
+      labels:
+        istio-discovery: enabled
+        istio.io/rev: default
+    istio-cni:
+      labels:
+        istio-discovery: enabled
+    istio-system:
+      labels:
+        istio-discovery: enabled
+    tempo:
+      labels:
+        istio-discovery: enabled
+    openshift-tempo-operator:
+      labels:
+        openshift.io/cluster-monitoring: true
+      operatorGroup: true
+      targetNamespaces:
+    openshift-opentelemetry-operator:
+      operatorGroup: true
+      targetNamespaces:
+    openshift-cluster-observability-operator:
+      labels:
+        openshift.io/cluster-monitoring: true
+      operatorGroup: true
+      targetNamespaces:
 
   subscriptions:
     servicemesh:
@@ -57,8 +60,12 @@ clusterGroup:
     cluster-observability:
       name: cluster-observability-operator
       namespace: openshift-cluster-observability-operator
+    eso:
+      name: openshift-external-secrets-operator
+      namespace: external-secrets-operator
+      channel: stable-v1
 
-  projects:
+  argoProjects:
     - hub
     - servicemesh
     - travelops
@@ -68,39 +75,39 @@ clusterGroup:
     vault:
       name: vault
       namespace: vault
-      project: hub
+      argoProject: hub
       chart: hashicorp-vault
       chartVersion: 0.1.*
-    golang-external-secrets:
-      name: golang-external-secrets
-      namespace: golang-external-secrets
-      project: hub
-      chart: golang-external-secrets
-      chartVersion: 0.1.*
+    openshift-external-secrets:
+      name: openshift-external-secrets
+      namespace: external-secrets
+      argoProject: hub
+      chart: openshift-external-secrets
+      chartVersion: 0.0.*
     mysql:
       name: mysqldb
       namespace: travel-agency
-      project: travelops
+      argoProject: travelops
       path: charts/all/travelops/mysqldb
     agency:
       name: travel-agency
       namespace: travel-agency
-      project: travelops
+      argoProject: travelops
       path: charts/all/travelops/travel-agency
     portal:
       name: travel-portal
       namespace: travel-portal
-      project: travelops
+      argoProject: travelops
       path: charts/all/travelops/travel-portal
     control:
       name: travel-control
       namespace: travel-control
-      project: travelops
+      argoProject: travelops
       path: charts/all/travelops/travel-control
     servicemesh:
       name: servicemesh
       namespace: istio-system
-      project: servicemesh
+      argoProject: servicemesh
       chart: servicemesh
       chartVersion: 0.1.*
       overrides:
@@ -109,14 +116,14 @@ clusterGroup:
     temposttack:
       name: tempostack
       namespace: tempo
-      project: distributed-tracing
+      argoProject: distributed-tracing
       path: charts/all/tempostack
       extraValueFiles:
         - /values-distributed-tracing.yaml
     tracing:
       name: distributed-tracing
       namespace: istio-system
-      project: distributed-tracing
+      argoProject: distributed-tracing
       path: charts/all/distributed-tracing
       extraValueFiles:
         - /values-distributed-tracing.yaml