diff --git a/.gitignore b/.gitignore
index f616ac9d9..429c6934e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,3 @@
-# where helm charts will get downloaded by kustomize
-/charts/
-
 # un-encrypted secrets
 /secret-*.yaml
 # sealed secrets
diff --git a/charts/understack/.helmignore b/charts/understack/.helmignore
new file mode 100644
index 000000000..0e8a0eb36
--- /dev/null
+++ b/charts/understack/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/understack/Chart.yaml b/charts/understack/Chart.yaml
new file mode 100644
index 000000000..e34c50a91
--- /dev/null
+++ b/charts/understack/Chart.yaml
@@ -0,0 +1,24 @@
+apiVersion: v2
+name: understack
+description: ArgoCD Application definitions for UnderStack
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"
diff --git a/charts/understack/templates/_helpers.tpl b/charts/understack/templates/_helpers.tpl
new file mode 100644
index 000000000..2328469b2
--- /dev/null
+++ b/charts/understack/templates/_helpers.tpl
@@ -0,0 +1,99 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "understack.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "understack.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "understack.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "understack.labels" -}}
+helm.sh/chart: {{ include "understack.chart" . }}
+{{ include "understack.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "understack.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "understack.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "understack.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "understack.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create a valid ArgoCD Application name
+*/}}
+{{- define "understack.argocdAppName" -}}
+{{- $root := index . 0 }}
+{{- $appName := index . 1 }}
+{{- printf "%s-%s" $root.Release.Name $appName }}
+{{- end }}
+
+{{/*
+Get the UnderStack repository URL
+*/}}
+{{- define "understack.understack_url" -}}
+{{- .Values.understack_url }}
+{{- end }}
+
+{{/*
+Get the UnderStack repository git reference
+*/}}
+{{- define "understack.understack_ref" -}}
+{{- .Values.understack_ref }}
+{{- end }}
+
+{{/*
+Get the deployment repository URL
+*/}}
+{{- define "understack.deploy_url" -}}
+{{- .Values.deploy_url }}
+{{- end }}
+
+{{/*
+Get the deployment repository git reference
+*/}}
+{{- define "understack.deploy_ref" -}}
+{{- .Values.deploy_ref }}
+{{- end }}
diff --git a/charts/understack/templates/application-openstack.yaml.tpl b/charts/understack/templates/application-openstack.yaml.tpl
new file mode 100644
index 000000000..fa81ea80b
--- /dev/null
+++ b/charts/understack/templates/application-openstack.yaml.tpl
@@ -0,0 +1,47 @@
+{{- range $appName, $app := .Values.site.openstack.apps }}
+{{- if $app.enabled }}
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ printf "%s-%s" $.Release.Name $appName }}
+  {{- with $app.wave }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ quote . }}
+  {{- end }}
+spec:
+  destination:
+    namespace: openstack
+    server: https://kubernetes.default.svc
+  project: understack
+  sources:
+  - repoURL: {{ $.Values.site.openstack.repoUrl }}
+    targetRevision: {{ $app.chartVersion }}
+    chart: {{ $appName }}
+    helm:
+      ignoreMissingValueFiles: true
+      releaseName: {{ $appName }}
+      valueFiles:
+      - $understack/components/images-openstack.yaml
+      - $understack/components/{{ $appName }}/values.yaml
+      - $deploy/{{ $.Release.Name }}/manifests/secret-openstack.yaml
+      - $deploy/{{ $.Release.Name }}/manifests/images-openstack.yaml
+      - $deploy/{{ $.Release.Name }}/helm-configs/{{ $appName }}.yaml
+  - path: components/{{ $appName }}/
+    ref: understack
+    repoURL: {{ include "understack.understack_url" $ }}
+    targetRevision: {{ include "understack.understack_ref" $ }}
+  - path: {{ $.Release.Name }}/manifests/{{ $appName }}
+    ref: deploy
+    repoURL: {{ include "understack.deploy_url" $ }}
+    targetRevision: {{ include "understack.deploy_ref" $ }}
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - ServerSideApply=false
+    - RespectIgnoreDifferences=true
+    - ApplyOutOfSyncOnly=true
+{{- end }}
+{{- end }}
diff --git a/charts/understack/values.yaml b/charts/understack/values.yaml
new file mode 100644
index 000000000..4e6ef309a
--- /dev/null
+++ b/charts/understack/values.yaml
@@ -0,0 +1,153 @@
+# -- Defines the UnderStack repository URL
+#    [[ref]](https://rackerlabs.github.io/understack/deploy-guide/requirements/)
+# @default -- https://github.com/rackerlabs/understack.git
+understack_url: https://github.com/rackerlabs/understack.git
+
+# -- Defines the UnderStack repository git reference (commit/branch/tag)
+#    [[ref]](https://rackerlabs.github.io/understack/deploy-guide/requirements/)
+# @default -- HEAD
+understack_ref: HEAD
+
+# -- Defines the deployment repository URL
+#    [[ref]](https://rackerlabs.github.io/understack/deploy-guide/requirements/)
+deploy_url:
+
+# -- Defines the deployment repository git reference (commit/branch/tag)
+#    [[ref]](https://rackerlabs.github.io/understack/deploy-guide/requirements/)
+# @default -- HEAD
+deploy_ref: HEAD
+
+# -- This block is for setting up the UnderStack site specific ArgoCD Applications
+site:
+  # -- Enable/disable deploying the site specific applications
+  # @default -- true
+  enabled: true
+
+  # -- OpenStack service applications configuration
+  openstack:
+    # -- OpenStack Helm chart repository URL
+    # @default -- https://tarballs.opendev.org/openstack/openstack-helm
+    repoUrl: https://tarballs.opendev.org/openstack/openstack-helm
+
+    # -- Dictionary of OpenStack applications to deploy
+    # @default -- See below for default apps
+    apps:
+      # -- Keystone (Identity Service)
+      keystone:
+        # -- Enable/disable deploying Keystone
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering (lower numbers deploy first)
+        # @default -- 1
+        wave: 1
+        # renovate: datasource=helm depName=keystone registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Keystone
+        chartVersion: 2025.1.5+95bf0bf6e
+
+      # -- Glance (Image Service)
+      glance:
+        # -- Enable/disable deploying Glance
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering
+        # @default -- 2
+        wave: 2
+        # renovate: datasource=helm depName=glance registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Glance
+        chartVersion: 2025.1.3+7bcc0b957
+
+      # -- Cinder (Block Storage Service)
+      cinder:
+        # -- Enable/disable deploying Cinder
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering
+        # @default -- 2
+        wave: 2
+        # renovate: datasource=helm depName=cinder registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Cinder
+        chartVersion: 2025.1.3+and55b4a7
+
+      # -- Ironic (Bare Metal Service)
+      ironic:
+        # -- Enable/disable deploying Ironic
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering
+        # @default -- 2
+        wave: 2
+        # renovate: datasource=helm depName=ironic registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Ironic
+        chartVersion: 2025.1.3+344314dd3
+
+      # -- Neutron (Networking Service)
+      neutron:
+        # -- Enable/disable deploying Neutron
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering
+        # @default -- 2
+        wave: 2
+        # renovate: datasource=helm depName=neutron registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Neutron
+        chartVersion: 2025.1.9+3225ad74a
+
+      # -- Placement (Placement Service)
+      placement:
+        # -- Enable/disable deploying Placement
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering
+        # @default -- 2
+        wave: 2
+        # renovate: datasource=helm depName=placement registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Placement
+        chartVersion: 2025.1.1+062261562
+
+      # -- Nova (Compute Service)
+      nova:
+        # -- Enable/disable deploying Nova
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering
+        # @default -- 3
+        wave: 3
+        # renovate: datasource=helm depName=nova registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Nova
+        chartVersion: 2025.1.19+12458c92d
+
+      # -- Octavia (Load Balancer Service)
+      octavia:
+        # -- Enable/disable deploying Octavia
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering
+        # @default -- 3
+        wave: 3
+        # renovate: datasource=helm depName=octavia registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Octavia
+        chartVersion: 2025.1.12+80041dfbb
+
+      # -- Horizon (Dashboard)
+      horizon:
+        # -- Enable/disable deploying Horizon
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering
+        # @default -- 4
+        wave: 4
+        # renovate: datasource=helm depName=horizon registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Horizon
+        chartVersion: 2025.1.8+95bf0bf6e
+
+      # -- Skyline (Dashboard)
+      skyline:
+        # -- Enable/disable deploying Skyline
+        # @default -- true
+        enabled: true
+        # -- Sync wave for deployment ordering
+        # @default -- 4
+        wave: 4
+        # renovate: datasource=helm depName=horizon registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
+        # -- Chart version for Skyline
+        chartVersion: 2025.1.3+0161bea65