diff --git a/Tiltfile b/Tiltfile
index e2727a264e..93987e642c 100644
--- a/Tiltfile
+++ b/Tiltfile
@@ -27,8 +27,8 @@ docker_build_with_restart(
 def helmfiles(chart, values):
 	watch_file(chart)
 	watch_file(values)
-	return local('./tools/bin/helm template {c} -f {v}'.format(c=chart, v=values))
+	return local('./tools/bin/helm template dev {c} -f {v}'.format(c=chart, v=values))
 
-k8s_yaml(helmfiles('./charts/weave-gitops', './tools/helm-values-dev.yaml'))
+k8s_yaml(helmfiles('./charts/gitops-server', './tools/helm-values-dev.yaml'))
 
-k8s_resource('wego-app', port_forwards='9001', resource_deps=['gitops-server'])
+k8s_resource('dev-weave-gitops', port_forwards='9001', resource_deps=['gitops-server'])
diff --git a/charts/weave-gitops/.helmignore b/charts/gitops-server/.helmignore
similarity index 100%
rename from charts/weave-gitops/.helmignore
rename to charts/gitops-server/.helmignore
diff --git a/charts/gitops-server/Chart.yaml b/charts/gitops-server/Chart.yaml
new file mode 100644
index 0000000000..cdfd38c6f2
--- /dev/null
+++ b/charts/gitops-server/Chart.yaml
@@ -0,0 +1,24 @@
+apiVersion: v2
+name: weave-gitops
+description: Weave Gitops is a set of tools and services to aid your interactions with Flux
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 1.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "v0.6.2"
diff --git a/charts/gitops-server/README.md b/charts/gitops-server/README.md
new file mode 100644
index 0000000000..42b467288f
--- /dev/null
+++ b/charts/gitops-server/README.md
@@ -0,0 +1,52 @@
+# Weave Gitops Helm Chart
+
+This is the [Weave Gitops](https://github.com/weaveworks/weave-gitops) [Helm](https://helm.sh) chart.
+
+It installs the weave-gitops-server component as a 1-replica deployment.
+
+Optionally it will also install:
+* Service Account
+* ClusterRoleBinding (to the service account) and ClusterRole with the
+  permissions required to run Gitops.
+* Service, this is optional as you may want to limit access to the UI to via
+  port-forwarding
+* Ingress
+* Test User -- A test user with hard-coded username & password with minimal
+  permissions
+
+This chart assumes kubernetes > 1.17
+
+## Security
+
+The role that this chart creates includes 2 main 'blocks' of permissions; that
+should be treated separately and carefully:
+
+* `impersonate` This is how the gitops-server gathers data to display in the UI,
+  it impersonates the user, determined by OIDC/plain auth. This means that
+  a user's permissions in the UI will reflect their permissions in the cluster
+* `get`, `list`, `watch` on `helmrepositories` and `secrets`. These permissions
+  are required by the profiles system.
+
+### Impersonate
+
+When deploying gitops-server it is recommended to limit the types of resource
+and specific resources that the service account can impersonate. e.g.
+```yaml
+rbac:
+  create: true
+  impersonationResources: ["groups"]
+  impersonationResourceNames: ["gitops-reader"]
+```
+
+Using groups is the recommended way of doing this as it means that you don't
+have to enumerate all users in a group.
+
+### Get helmrepositories
+
+This permissions are scoped to enable the profiles functionality of gitops-server
+and should not need to change.
+
+### Test User
+
+This user should not be used, it is intended for development and testing
+purposes and relies on static credentials in a secret.
diff --git a/charts/gitops-server/templates/NOTES.txt b/charts/gitops-server/templates/NOTES.txt
new file mode 100644
index 0000000000..319f01bdad
--- /dev/null
+++ b/charts/gitops-server/templates/NOTES.txt
@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "chart.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "chart.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "chart.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "chart.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
diff --git a/charts/gitops-server/templates/_helpers.tpl b/charts/gitops-server/templates/_helpers.tpl
new file mode 100644
index 0000000000..af32c5b6e6
--- /dev/null
+++ b/charts/gitops-server/templates/_helpers.tpl
@@ -0,0 +1,77 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "chart.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "chart.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "chart.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "chart.labels" -}}
+helm.sh/chart: {{ include "chart.chart" . }}
+{{ include "chart.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "chart.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "chart.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "chart.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "chart.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return the target Kubernetes version
+*/}}
+{{- define "common.capabilities.kubeVersion" -}}
+{{- if .Values.global }}
+    {{- if .Values.global.kubeVersion }}
+    {{- .Values.global.kubeVersion -}}
+    {{- else }}
+    {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}}
+    {{- end -}}
+{{- else }}
+{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/gitops-server/templates/admin-user.yaml b/charts/gitops-server/templates/admin-user.yaml
new file mode 100644
index 0000000000..9ab1c8f66f
--- /dev/null
+++ b/charts/gitops-server/templates/admin-user.yaml
@@ -0,0 +1,65 @@
+{{- if .Values.adminUser.create }}
+# This should not be used in production. It is for testing & demo purposes only
+# FIXME issues #1789, #1787, #1671
+# the contents of this file are dependent upon the outcome of several
+# discussions around usage of the admin user. Once those are resolved the
+# configuration here should be brought into line with those outcomes (e.g.
+# names(paces) made configurable, permissions set).
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: wego-test-user-read-resources
+  namespace: flux-system
+subjects:
+  - kind: User
+    name: wego-admin
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: wego-admin-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: wego-admin-role
+  namespace: flux-system
+rules:
+  - apiGroups: [""]
+    resources: ["secrets", "pods" ]
+    verbs: [ "get", "list" ]
+  - apiGroups: ["apps"]
+    resources: [ "deployments", "replicasets", "pods" ]
+    verbs: [ "get", "list" ]
+  - apiGroups: ["kustomize.toolkit.fluxcd.io"]
+    resources: [ "kustomizations" ]
+    verbs: [ "get", "list" ]
+  - apiGroups: ["helm.toolkit.fluxcd.io"]
+    resources: [ "helmreleases" ]
+    verbs: [ "get", "list" ]
+  - apiGroups: ["source.toolkit.fluxcd.io"]
+    resources: [ "buckets", "helmcharts", "gitrepositories", "helmrepositories" ]
+    verbs: [ "get", "list" ]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "watch", "list"]
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cluster-user-auth
+  namespace: flux-system
+type: Opaque
+data:
+  {{- with .Values.adminUser }}
+  username: {{ .username | b64enc | quote }}
+  {{/*
+    htpasswd returns user-file format, e.g. 'username:passwordhash' so as well
+    as using htpasswd to generate the bcrypt hash we also need to extract the
+    final element before base64 enconding it for k8s (and quoting it b/c yaml)
+  */}}
+   {{- $bcryptPasswordHash := .password | required "You must set a password for this user!" | htpasswd "" }}
+  password: {{ regexSplit ":" $bcryptPasswordHash -1 | last | b64enc | quote }}
+  {{- end }}
+{{- end }}
diff --git a/charts/gitops-server/templates/deployment.yaml b/charts/gitops-server/templates/deployment.yaml
new file mode 100644
index 0000000000..cbee6d2b19
--- /dev/null
+++ b/charts/gitops-server/templates/deployment.yaml
@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "chart.fullname" . }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "chart.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "chart.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "chart.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - "--helm-repo-namespace"
+            - "{{ .Release.Namespace }}"
+            - "--log-level"
+            - "{{ .Values.logLevel }}"
+          {{- with .Values.additionalArgs }}
+            {{- range . }}
+            - {{ . | quote }}
+            {{- end }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: 9001
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          {{- if or .Values.enableLogin .Values.envVars}}
+          env:
+          {{- if .Values.enableLogin }}
+            - name: WEAVE_GITOPS_AUTH_ENABLED
+              value: "true"
+          {{- end }}
+          {{- with .Values.envVars }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/charts/gitops-server/templates/ingress.yaml b/charts/gitops-server/templates/ingress.yaml
new file mode 100644
index 0000000000..63c1311c95
--- /dev/null
+++ b/charts/gitops-server/templates/ingress.yaml
@@ -0,0 +1,61 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "chart.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}
diff --git a/charts/gitops-server/templates/role.yaml b/charts/gitops-server/templates/role.yaml
new file mode 100644
index 0000000000..4487f87ef1
--- /dev/null
+++ b/charts/gitops-server/templates/role.yaml
@@ -0,0 +1,32 @@
+{{- if .Values.rbac.create -}}
+{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- end }}
+kind: ClusterRole
+metadata:
+  name:  {{ include "chart.fullname" . }}
+rules:
+  # impersonation rules for ui calls
+  - apiGroups: [""]
+    resources: {{ .Values.rbac.impersonationResources | toJson }}
+    verbs: [ "impersonate" ]
+    {{- with .Values.rbac.impersonationResourceNames }}
+    resourceNames: {{ . | toJson }}
+    {{- end }}
+  # Access to enterprise entitlement
+  - apiGroups: [""]
+    resources: [ "secrets" ]
+    verbs: [ "get", "list" ]
+    {{- with .Values.rbac.viewSecrets }}
+    resourceNames: {{ . | toJson }}
+    {{- end }}
+  # helm repository rules for...?
+  - apiGroups: [ "source.toolkit.fluxcd.io" ]
+    resources: [ "helmrepositories" ]
+    verbs: [ "get", "list", "watch" ]
+  - apiGroups: [ "source.toolkit.fluxcd.io" ]
+    resources: [ "helmrepositories/finalizers", "helmrepositories/status" ]
+    verbs: [ "get" ]
+{{- end -}}
diff --git a/charts/gitops-server/templates/rolebinding.yaml b/charts/gitops-server/templates/rolebinding.yaml
new file mode 100644
index 0000000000..b8756fec3f
--- /dev/null
+++ b/charts/gitops-server/templates/rolebinding.yaml
@@ -0,0 +1,24 @@
+{{- if .Values.rbac.create -}}
+{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- end }}
+kind: ClusterRoleBinding
+metadata:
+  name:  {{ include "chart.fullname" . }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+  {{- with .Values.rbac.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "chart.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "chart.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end -}}
diff --git a/charts/gitops-server/templates/service.yaml b/charts/gitops-server/templates/service.yaml
new file mode 100644
index 0000000000..da69993775
--- /dev/null
+++ b/charts/gitops-server/templates/service.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.service.create -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "chart.fullname" . }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "chart.selectorLabels" . | nindent 4 }}
+{{- end -}}
diff --git a/charts/gitops-server/templates/serviceaccount.yaml b/charts/gitops-server/templates/serviceaccount.yaml
new file mode 100644
index 0000000000..26a57fa869
--- /dev/null
+++ b/charts/gitops-server/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "chart.serviceAccountName" . }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/gitops-server/templates/tests/test-connection.yaml b/charts/gitops-server/templates/tests/test-connection.yaml
new file mode 100644
index 0000000000..8dfed872de
--- /dev/null
+++ b/charts/gitops-server/templates/tests/test-connection.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "chart.fullname" . }}-test-connection"
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "chart.fullname" . }}:{{ .Values.service.port }}']
+  restartPolicy: Never
diff --git a/charts/gitops-server/values.yaml b/charts/gitops-server/values.yaml
new file mode 100644
index 0000000000..4a549b6ff2
--- /dev/null
+++ b/charts/gitops-server/values.yaml
@@ -0,0 +1,110 @@
+# Default values for chart.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+  # FIXME check the app name
+  repository: ghcr.io/weaveworks/wego-app
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: "v0.6.2"
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+# Sets the WEAVE_GITOPS_AUTH_ENABLED environment variable to enable auth systems
+enableLogin: true
+# valid levels are 'debug', 'info', 'warn' and 'error'
+logLevel: info
+# Additional arguments to pass in
+# additionalArgs:
+# Any other environment variables:
+# envVars:
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+rbac:
+  # Specifies whether the clusterRole & binding to the service account should be created
+  create: true
+  # List of resources that the service account can impersonate. It is strongly
+  # recommended that you configure groups that can be used to populate this.
+  impersonationResourceNames: []
+  # Limit the type of principal that can be impersonated
+  impersonationResources: [ "users", "groups" ]
+  # Specify whether additional permissions should be granted to the service account
+  # in order to work with weave-gitops enterprise
+  viewSecrets: []
+
+# This should not be used in production
+adminUser:
+  # Whether the wego-admin user should be created.
+  # If you use this make sure you add it to rbac.impersonationResourceNames.
+  create: false
+  # Set the username and password, these will be stored in a secret in k8s.
+  username: gitops-test-user
+  # The password will be hashed using the bcrypt algorithm.
+  # It should not be stored in plain-text so is best passed using a set flag:
+  # --set adminUser.password="My $uper secure password that is not this $tring"
+  # password:
+
+podAnnotations: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  create: true
+  type: ClusterIP
+  port: 9001
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  hosts:
+    - host: chart-example.local
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - chart-example.local
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
diff --git a/charts/weave-gitops/Chart.yaml b/charts/weave-gitops/Chart.yaml
deleted file mode 100644
index 04d0e7b90b..0000000000
--- a/charts/weave-gitops/Chart.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: v2
-name: weave-gitops
-description: A Helm chart for Weave Gitops
-version: 1.0.0
-appVersion: "v0.6.2"
diff --git a/charts/weave-gitops/templates/admin.yaml b/charts/weave-gitops/templates/admin.yaml
deleted file mode 100644
index f001d95c70..0000000000
--- a/charts/weave-gitops/templates/admin.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: wego-admin-read-resources
-  namespace: {{.Values.namespace}}
-subjects:
-  - kind: User
-    name: wego-admin
-    namespace: {{.Values.namespace}}
-roleRef:
-  kind: Role
-  name: wego-admin-user-role
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: wego-admin-user-role
-  namespace: {{.Values.namespace}}
-rules:
-  - apiGroups: [""]
-    resources: ["secrets", "pods" ]
-    verbs: [ "get", "list" ]
-  - apiGroups: ["apps"]
-    resources: [ "deployments", "replicasets", "pods" ]
-    verbs: [ "get", "list" ]
-  - apiGroups: ["kustomize.toolkit.fluxcd.io"]
-    resources: [ "kustomizations" ]
-    verbs: [ "get", "list" ]
-  - apiGroups: ["helm.toolkit.fluxcd.io"]
-    resources: [ "helmreleases" ]
-    verbs: [ "get", "list" ]
-  - apiGroups: ["source.toolkit.fluxcd.io"]
-    resources: [ "buckets", "helmcharts", "gitrepositories", "helmrepositories" ]
-    verbs: [ "get", "list" ]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["get", "watch", "list"]
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cluster-user-auth
-  namespace: {{.Values.namespace}}
-type: Opaque
-data:
-  username: {{.Values.adminUsername}}
-  password: {{.Values.adminPassword}}
diff --git a/charts/weave-gitops/templates/wego-app.yaml b/charts/weave-gitops/templates/wego-app.yaml
deleted file mode 100644
index 8541989b04..0000000000
--- a/charts/weave-gitops/templates/wego-app.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wego-app
-  namespace: {{.Values.namespace}}
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: wego-app
-    spec:
-      serviceAccountName: wego-app-service-account
-      containers:
-        - name: wego-app
-          image: "{{.Values.containerRegistry}}:{{.Values.image}}"
-          args: [ "--log-level", "{{.Values.wegoServerLogLevel}}", "--helm-repo-namespace", "{{.Values.namespace}}" ]
-          ports:
-            - containerPort: 9001
-              protocol: TCP
-          imagePullPolicy: IfNotPresent
-          env:
-          - name: WEAVE_GITOPS_AUTH_ENABLED
-            value: "true"
-  selector:
-    matchLabels:
-      app: wego-app
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: weave-gitops-binding
-subjects:
-  - kind: ServiceAccount
-    name: wego-app-service-account
-    namespace: {{.Values.namespace}}
-roleRef:
-  kind: ClusterRole
-  name: weave-gitops-role
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: helm-watcher-rolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: helm-watcher-role
-subjects:
-  - kind: ServiceAccount
-    name: wego-app-service-account
-    namespace: {{ .Values.namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: weave-gitops-role
-rules:
-  - apiGroups: [""]
-    resources: [ "users", "groups", "serviceaccounts" ]
-    verbs: [ "impersonate" ]
-  - apiGroups: [""]
-    resources: [ "secrets" ]
-    verbs: [ "get", "list" ]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: helm-watcher-role
-rules:
-  - apiGroups: [ "source.toolkit.fluxcd.io" ]
-    resources: [ "helmrepositories" ]
-    verbs: [ "get", "list", "watch" ]
-  - apiGroups: [ "source.toolkit.fluxcd.io" ]
-    resources: [ "helmrepositories/finalizers", "helmrepositories/status" ]
-    verbs: [ "get" ]
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: wego-app-service-account
-  namespace: {{.Values.namespace}}
-secrets:
-  - name: wego-app-service-account-token
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wego-app
-  namespace: {{.Values.namespace}}
-spec:
-  selector:
-    app: wego-app
-  ports:
-    - protocol: TCP
-      port: 9001
-      targetPort: 9001
diff --git a/charts/weave-gitops/values.yaml b/charts/weave-gitops/values.yaml
deleted file mode 100644
index ff61595254..0000000000
--- a/charts/weave-gitops/values.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-namespace: flux-system
-image: v0.6.2
-containerRegistry: ghcr.io/weaveworks/wego-app
-wegoServerLogLevel: info
-adminUsername: YWRtaW4=
-adminPassword:
diff --git a/tools/helm-values-dev.yaml b/tools/helm-values-dev.yaml
index c0e038b5ea..9ea105156c 100644
--- a/tools/helm-values-dev.yaml
+++ b/tools/helm-values-dev.yaml
@@ -1,6 +1,12 @@
 ---
-image: latest
-containerRegistry: localhost:5001/weaveworks/wego-app
-adminUsername: ZGV2
-adminPassword: JDJiJDEyJEU5STRSU01VWTVMYUJrVHNQLmxiTy4zTDB2M1BTUHZIb1htN29kSE80TXN4MXZiZmVwRzdX
-namespace: flux-system
+image:
+  tag: latest
+  repository: localhost:5001/weaveworks/wego-app
+
+logLevel: debug
+enableLogin: true
+
+adminUser:
+  create: true
+  username: dev
+  password: dev