diff --git a/.tools/nvim/__http__/infra/clusters.graphql.yml b/.tools/nvim/__http__/infra/clusters.graphql.yml
index 4555adb2f..1c2c7c46f 100644
--- a/.tools/nvim/__http__/infra/clusters.graphql.yml
+++ b/.tools/nvim/__http__/infra/clusters.graphql.yml
@@ -277,8 +277,8 @@ query: |+ #graphql
     infra_upgradeHelmKloudliteAgent(clusterName: $clusterName)
   }
 variables:
-  # clusterName: "{{.clusterName}}"
-  clusterName: "{{.gcpClusterName}}"
+  clusterName: "{{.clusterName}}"
+  # clusterName: "{{.gcpClusterName}}"
 ---
 
 label: Delete Cluster
diff --git a/Taskfile.yml b/Taskfile.yml
index ba859a40f..028bade9a 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -10,7 +10,7 @@ tasks:
 
           banner="// Code generated by mocki. DO NOT EDIT."
 
-          mock_module_path=$(echo $package_path | sed 's/kloudlite.io\///')
+          mock_module_path=$(echo $package_path | sed 's/github.com\/kloudlite\/api\///')
           file_name=$(echo $interface_name | awk '{print tolower($0)}')
           file_name+=".go"
 
@@ -26,39 +26,43 @@ tasks:
 
           printf "mocking $package_path.$interface_name "
           mkdir -p mocks/$mock_module_path
+          set -x 
+          whereis mocki
           mocki --package $package_path --interface $interface_name > mocks/$mock_module_path/$file_name
+          set +x
           echo "✅"
         }
 
-        gen_mock kloudlite.io/pkg/repos DbRepo
+        gen_mock github.com/kloudlite/api/pkg/repos DbRepo
 
-        gen_mock kloudlite.io/pkg/k8s Client
-        gen_mock kloudlite.io/apps/infra/internal/domain AccountsSvc
+        gen_mock github.com/kloudlite/api/pkg/k8s Client
 
-        gen_mock kloudlite.io/grpc-interfaces/kloudlite.io/rpc/iam IAMClient
-        gen_mock kloudlite.io/grpc-interfaces/kloudlite.io/rpc/accounts AccountsClient
-        gen_mock kloudlite.io/grpc-interfaces/kloudlite.io/rpc/message-office-internal MessageOfficeInternalClient
-
-        gen_mock kloudlite.io/pkg/kafka Producer
-        gen_mock kloudlite.io/pkg/kafka Consumer
+        # gen_mock github.com/kloudlite/api/apps/infra/internal/domain AccountsSvc
+        #
+        # gen_mock github.com/kloudlite/api/grpc-interfaces/github.com/kloudlite/api/rpc/iam IAMClient
+        # gen_mock github.com/kloudlite/api/grpc-interfaces/github.com/kloudlite/api/rpc/accounts AccountsClient
+        # gen_mock github.com/kloudlite/api/grpc-interfaces/github.com/kloudlite/api/rpc/message-office-internal MessageOfficeInternalClient
+        #
+        # gen_mock github.com/kloudlite/api/pkg/kafka Producer
+        # gen_mock github.com/kloudlite/api/pkg/kafka Consumer
 
       # - mkdir -p pkg/repos/mocks
-      # - mocki --package kloudlite.io/pkg/repos --interface DbRepo > pkg/repos/mocks/db-repo.go
+      # - mocki --package github.com/kloudlite/api/pkg/repos --interface DbRepo > pkg/repos/mocks/db-repo.go
       #
       # - mkdir -p pkg/k8s/mocks
-      # - mocki --package kloudlite.io/pkg/k8s --interface ExtendedK8sClient  > pkg/k8s/mocks/extended-k8s-client.go
+      # - mocki --package github.com/kloudlite/api/pkg/k8s --interface ExtendedK8sClient  > pkg/k8s/mocks/extended-k8s-client.go
       #
       # # grpc-interfaces mocks
-      # - mkdir -p mocks/grpc-interfaces/kloudlite.io/rpc/iam
-      # - mocki --package kloudlite.io/grpc-interfaces/kloudlite.io/rpc/iam --interface IAMClient > mocks/grpc-interfaces/kloudlite.io/rpc/iam/iam-client.go
+      # - mkdir -p mocks/grpc-interfaces/github.com/kloudlite/api/rpc/iam
+      # - mocki --package github.com/kloudlite/api/grpc-interfaces/github.com/kloudlite/api/rpc/iam --interface IAMClient > mocks/grpc-interfaces/github.com/kloudlite/api/rpc/iam/iam-client.go
       #
-      # - mkdir -p mocks/grpc-interfaces/kloudlite.io/rpc/accounts
-      # - mocki --package kloudlite.io/grpc-interfaces/kloudlite.io/rpc/accounts --interface AccountsClient > mocks/grpc-interfaces/kloudlite.io/rpc/accounts/accounts-client.go
+      # - mkdir -p mocks/grpc-interfaces/github.com/kloudlite/api/rpc/accounts
+      # - mocki --package github.com/kloudlite/api/grpc-interfaces/github.com/kloudlite/api/rpc/accounts --interface AccountsClient > mocks/grpc-interfaces/github.com/kloudlite/api/rpc/accounts/accounts-client.go
       #
-      # - mkdir -p mocks/grpc-interfaces/kloudlite.io/rpc/message-office-internal
+      # - mkdir -p mocks/grpc-interfaces/github.com/kloudlite/api/rpc/message-office-internal
       #
       # # pkg/kafka mocks
       # - mkdir -p mocks/pkg/kafka
-      # - mocki --package kloudlite.io/pkg/kafka --interface Producer > mocks/pkg/kafka/producer.go
-      # - mocki --package kloudlite.io/pkg/kafka --interface Consumer > mocks/pkg/kafka/consumer.go
+      # - mocki --package github.com/kloudlite/api/pkg/kafka --interface Producer > mocks/pkg/kafka/producer.go
+      # - mocki --package github.com/kloudlite/api/pkg/kafka --interface Consumer > mocks/pkg/kafka/consumer.go
       #
diff --git a/apps/container-registry/internal/domain/build.go b/apps/container-registry/internal/domain/build.go
index c5f315a84..88f96fa0f 100644
--- a/apps/container-registry/internal/domain/build.go
+++ b/apps/container-registry/internal/domain/build.go
@@ -245,7 +245,8 @@ func (d *Impl) TriggerBuild(ctx RegistryContext, buildId repos.ID) error {
 		return errors.Newf("provider %s not supported", b.Source.Provider)
 	}
 
-	at, err := d.getAccessTokenByUserId(ctx, string(b.Source.Provider), ctx.UserId)
+	// at, err := d.getAccessTokenByUserId(ctx, string(b.Source.Provider), ctx.UserId)
+	at, err := d.getAccessTokenByUserId(ctx, string(b.Source.Provider), b.CreatedBy.UserId)
 	if err != nil {
 		return errors.NewE(err)
 	}
diff --git a/apps/infra/internal/domain/clusters.go b/apps/infra/internal/domain/clusters.go
index 120a3075a..a7325731e 100644
--- a/apps/infra/internal/domain/clusters.go
+++ b/apps/infra/internal/domain/clusters.go
@@ -1,6 +1,7 @@
 package domain
 
 import (
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 
@@ -318,31 +319,45 @@ func (d *domain) CreateCluster(ctx InfraContext, cluster entities.Cluster) (*ent
 
 	d.resourceEventPublisher.PublishInfraEvent(ctx, ResourceTypeCluster, nCluster.Name, PublishAdd)
 
-	if err := d.applyHelmKloudliteAgent(ctx, nCluster.Name, string(tokenScrt.Data[keyClusterToken]), nCluster.Spec.PublicDNSHost, string(nCluster.Spec.CloudProvider)); err != nil {
+	if err := d.applyHelmKloudliteAgent(ctx, string(tokenScrt.Data[keyClusterToken]), nCluster); err != nil {
 		return nil, errors.NewE(err)
 	}
 
 	return nCluster, nil
 }
 
-func (d *domain) applyHelmKloudliteAgent(ctx InfraContext, clusterName string, clusterToken string, clusterPublicHost string, cloudprovider string) error {
+func (d *domain) applyHelmKloudliteAgent(ctx InfraContext, clusterToken string, cluster *entities.Cluster) error {
 	b, err := templates.Read(templates.HelmKloudliteAgent)
 	if err != nil {
 		return errors.NewE(err)
 	}
 
-	b2, err := templates.ParseBytes(b, map[string]any{
+	values := map[string]any{
 		"account-name": ctx.AccountName,
 
-		"cluster-name":  clusterName,
+		"cluster-name":  cluster.Name,
 		"cluster-token": clusterToken,
 
 		"kloudlite-release":        d.env.KloudliteRelease,
 		"message-office-grpc-addr": d.env.MessageOfficeExternalGrpcAddr,
 
-		"public-dns-host": clusterPublicHost,
-		"cloudprovider":   cloudprovider,
-	})
+		"public-dns-host": cluster.Spec.PublicDNSHost,
+		"cloudprovider":   cluster.Spec.CloudProvider,
+	}
+
+	if cluster.Spec.CloudProvider == ct.CloudProviderGCP {
+		var credsSecret corev1.Secret
+		if err := d.k8sClient.Get(ctx, fn.NN(cluster.Spec.GCP.CredentialsRef.Namespace, cluster.Spec.GCP.CredentialsRef.Name), &credsSecret); err != nil {
+			return err
+		}
+		gcpCreds, err := fn.JsonConvert[clustersv1.GCPCredentials](credsSecret.Data)
+		if err != nil {
+			return err
+		}
+		values["gcp-service-account-json"] = base64.StdEncoding.EncodeToString([]byte(gcpCreds.ServiceAccountJSON))
+	}
+
+	b2, err := templates.ParseBytes(b, values)
 	if err != nil {
 		return errors.NewE(err)
 	}
@@ -373,18 +388,18 @@ func (d *domain) applyHelmKloudliteAgent(ctx InfraContext, clusterName string, c
 			},
 		},
 		AccountName: ctx.AccountName,
-		ClusterName: clusterName,
+		ClusterName: cluster.Name,
 		SyncStatus:  t.GenSyncStatus(t.SyncActionApply, 0),
 	}
 
 	hr.IncrementRecordVersion()
 
-	uhr, err := d.upsertHelmRelease(ctx, clusterName, &hr)
+	uhr, err := d.upsertHelmRelease(ctx, cluster.Name, &hr)
 	if err != nil {
 		return errors.NewE(err)
 	}
 
-	if err := d.resDispatcher.ApplyToTargetCluster(ctx, clusterName, &uhr.HelmChart, uhr.RecordVersion); err != nil {
+	if err := d.resDispatcher.ApplyToTargetCluster(ctx, cluster.Name, &uhr.HelmChart, uhr.RecordVersion); err != nil {
 		return errors.NewE(err)
 	}
 
@@ -405,7 +420,7 @@ func (d *domain) UpgradeHelmKloudliteAgent(ctx InfraContext, clusterName string)
 		return errors.NewE(err)
 	}
 
-	if err := d.applyHelmKloudliteAgent(ctx, clusterName, out.ClusterToken, cluster.Spec.PublicDNSHost, string(cluster.Spec.CloudProvider)); err != nil {
+	if err := d.applyHelmKloudliteAgent(ctx, out.ClusterToken, cluster); err != nil {
 		return errors.NewE(err)
 	}
 
diff --git a/apps/infra/internal/domain/clusters_test b/apps/infra/internal/domain/clusters_test
index f65339db8..5988f8406 100644
--- a/apps/infra/internal/domain/clusters_test
+++ b/apps/infra/internal/domain/clusters_test
@@ -42,7 +42,6 @@ func TestCreateCluster(t *testing.T) {
 
 		k8sClient k8sMock.Client
 
-
 		iamClient                   iamMock.IAMClient
 		accountsSvc                 domainMocks.AccountsSvc
 		messageOfficeInternalClient msgOfficeInternalMock.MessageOfficeInternalClient
diff --git a/apps/infra/internal/domain/mocks/accountssvc.go b/apps/infra/internal/domain/mocks/accountssvc.go
deleted file mode 100644
index 9ae81d021..000000000
--- a/apps/infra/internal/domain/mocks/accountssvc.go
+++ /dev/null
@@ -1,35 +0,0 @@
-// Code generated by mocki. DO NOT EDIT.
-package mocks
-
-import (
-	context "context"
-	accounts "github.com/kloudlite/api/grpc-interfaces/kloudlite.io/rpc/accounts"
-)
-
-type AccountsSvcCallerInfo struct {
-	Args []any
-}
-
-type AccountsSvc struct {
-	Calls          map[string][]AccountsSvcCallerInfo
-	MockGetAccount func(ctx context.Context, userId string, accountName string) (*accounts.GetAccountOut, error)
-}
-
-func (m *AccountsSvc) registerCall(funcName string, args ...any) {
-	if m.Calls == nil {
-		m.Calls = map[string][]AccountsSvcCallerInfo{}
-	}
-	m.Calls[funcName] = append(m.Calls[funcName], AccountsSvcCallerInfo{Args: args})
-}
-
-func (aMock *AccountsSvc) GetAccount(ctx context.Context, userId string, accountName string) (*accounts.GetAccountOut, error) {
-	if aMock.MockGetAccount != nil {
-		aMock.registerCall("GetAccount", ctx, userId, accountName)
-		return aMock.MockGetAccount(ctx, userId, accountName)
-	}
-	panic("AccountsSvc: method 'GetAccount' not implemented, yet")
-}
-
-func NewAccountsSvc() *AccountsSvc {
-	return &AccountsSvc{}
-}
diff --git a/apps/infra/internal/domain/templates/helm-charts-kloudlite-agent.yml.tpl b/apps/infra/internal/domain/templates/helm-charts-kloudlite-agent.yml.tpl
index 031b8f2e7..ca9efb374 100644
--- a/apps/infra/internal/domain/templates/helm-charts-kloudlite-agent.yml.tpl
+++ b/apps/infra/internal/domain/templates/helm-charts-kloudlite-agent.yml.tpl
@@ -9,6 +9,12 @@
 
 {{- $cloudprovider := get . "cloudprovider" }}
 
+{{- $gcpServiceAccountJson := get . "gcp-service-account-json" | default "" }}
+
+{{- if and (eq $cloudprovider "gcp") (not $gcpServiceAccountJson) }}
+{{fail "when cloudprovider is gcp, field `gcp-service-account-json` is required"}}
+{{- end }}
+
 ---
 apiVersion: crds.kloudlite.io/v1
 kind: HelmChart
@@ -25,7 +31,7 @@ spec:
       - operator: Exists
     
   preInstall: |+
-    kubectl apply -f https://github.com/kloudlite/helm-charts/releases/download/{{$kloudliteRelease}}/crds-kloudlite.yml
+    kubectl apply -f https://github.com/kloudlite/helm-charts/releases/download/{{$kloudliteRelease}}/crds-kloudlite.yml --server-side
 
   postInstall: |+
     if kubectl get ns kloudlite-tmp;
@@ -58,6 +64,13 @@ spec:
 
     cloudProvider: "{{$cloudprovider}}"
 
+    {{- if (eq $cloudprovider "gcp") }}
+    gcp:
+      gcloudServiceAccountCreds:
+        # -- base64 encoded service account json
+        json: {{$gcpServiceAccountJson}}
+    {{- end }}
+
     agent:
       enabled: true
       name: kl-agent
diff --git a/apps/infra/internal/entities/field-constants/generated_constants.go b/apps/infra/internal/entities/field-constants/generated_constants.go
index 2b1e84517..588e12c65 100644
--- a/apps/infra/internal/entities/field-constants/generated_constants.go
+++ b/apps/infra/internal/entities/field-constants/generated_constants.go
@@ -75,6 +75,8 @@ const (
 	BYOKClusterGcpMasterNodesRootVolumeSize        = "gcp.masterNodes.rootVolumeSize"
 	BYOKClusterGcpMasterNodesRootVolumeType        = "gcp.masterNodes.rootVolumeType"
 	BYOKClusterGcpRegion                           = "gcp.region"
+	BYOKClusterGcpVpc                              = "gcp.vpc"
+	BYOKClusterGcpVpcName                          = "gcp.vpc.name"
 	BYOKClusterKloudliteRelease                    = "kloudliteRelease"
 	BYOKClusterMessageQueueTopicName               = "messageQueueTopicName"
 	BYOKClusterOutput                              = "output"
@@ -155,6 +157,8 @@ const (
 	ClusterSpecGcpMasterNodesRootVolumeSize        = "spec.gcp.masterNodes.rootVolumeSize"
 	ClusterSpecGcpMasterNodesRootVolumeType        = "spec.gcp.masterNodes.rootVolumeType"
 	ClusterSpecGcpRegion                           = "spec.gcp.region"
+	ClusterSpecGcpVpc                              = "spec.gcp.vpc"
+	ClusterSpecGcpVpcName                          = "spec.gcp.vpc.name"
 	ClusterSpecKloudliteRelease                    = "spec.kloudliteRelease"
 	ClusterSpecMessageQueueTopicName               = "spec.messageQueueTopicName"
 	ClusterSpecOutput                              = "spec.output"
@@ -172,7 +176,9 @@ const (
 
 // constant vars generated for struct ClusterConnection
 const (
+	ClusterConnectionCidr                         = "cidr"
 	ClusterConnectionClusterGroupName             = "clusterGroupName"
+	ClusterConnectionEndpoint                     = "endpoint"
 	ClusterConnectionSpec                         = "spec"
 	ClusterConnectionSpecAgentsResources          = "spec.agentsResources"
 	ClusterConnectionSpecAgentsResourcesClaims    = "spec.agentsResources.claims"
@@ -192,9 +198,7 @@ const (
 )
 
 // constant vars generated for struct ClusterGroup
-const (
-	ClusterGroupPeers = "peers"
-)
+const ()
 
 // constant vars generated for struct ClusterManagedService
 const (
@@ -378,12 +382,10 @@ const (
 	OutputFieldName        = "name"
 )
 
-// constant vars generated for struct Peers
+// constant vars generated for struct Peer
 const (
-	PeersAllowedIps = "allowedIps"
-	PeersName       = "name"
-	PeersNamespace  = "namespace"
-	PeersPubKey     = "pubKey"
+	PeerAllowedIps = "allowedIps"
+	PeerPubKey     = "pubKey"
 )
 
 // constant vars generated for struct PersistentVolume
diff --git a/cmd/mocki/Taskfile.yml b/cmd/mocki/Taskfile.yml
index 712457faf..692c3650d 100644
--- a/cmd/mocki/Taskfile.yml
+++ b/cmd/mocki/Taskfile.yml
@@ -3,6 +3,8 @@ version: 3
 tasks:
   install:
     dir: ../..
+    env:
+      CGO_ENABLED: 0
     cmds: 
       - mkdir -p bin
       - go build -o ./bin/mocki ./cmd/mocki
diff --git a/cmd/mocki/internal/parser/parser_test.go b/cmd/mocki/internal/parser/parser_test.go
index 08abe9ed9..32917d2f0 100644
--- a/cmd/mocki/internal/parser/parser_test.go
+++ b/cmd/mocki/internal/parser/parser_test.go
@@ -22,7 +22,7 @@ func TestFindAndParseInterface(t *testing.T) {
 		{
 			name: "test 1: normal interface",
 			args: args{
-				packagePath:   "kloudlite.io/cmd/mocki/internal/parser/test_data",
+				packagePath:   "github.com/kloudlite/api/cmd/mocki/internal/parser/test_data",
 				interfaceName: "Type1",
 			},
 			want: &parser.Info{
@@ -47,18 +47,18 @@ func TestFindAndParseInterface(t *testing.T) {
 		{
 			name: "test 2: generic interface, with any constraint",
 			args: args{
-				packagePath:   "kloudlite.io/cmd/mocki/internal/parser/test_data",
+				packagePath:   "github.com/kloudlite/api/cmd/mocki/internal/parser/test_data",
 				interfaceName: "Type2",
 			},
 			want: &parser.Info{
 				Imports: map[string]parser.ImportInfo{
-					"kloudlite.io/cmd/mocki/internal/parser/test_data": {
+					"github.com/kloudlite/api/cmd/mocki/internal/parser/test_data": {
 						Alias:       "test_data",
-						PackagePath: "kloudlite.io/cmd/mocki/internal/parser/test_data",
+						PackagePath: "github.com/kloudlite/api/cmd/mocki/internal/parser/test_data",
 					},
-					"kloudlite.io/pkg/repos": {
+					"github.com/kloudlite/api/pkg/repos": {
 						Alias:       "repos",
-						PackagePath: "kloudlite.io/pkg/repos",
+						PackagePath: "github.com/kloudlite/api/pkg/repos",
 					},
 				},
 				Implementations: []string{
@@ -99,14 +99,14 @@ func TestFindAndParseInterface(t *testing.T) {
 		{
 			name: "test 3: generic interface with another interface as constraint",
 			args: args{
-				packagePath:   "kloudlite.io/cmd/mocki/internal/parser/test_data",
+				packagePath:   "github.com/kloudlite/api/cmd/mocki/internal/parser/test_data",
 				interfaceName: "Type3",
 			},
 			want: &parser.Info{
 				Imports: map[string]parser.ImportInfo{
-					"kloudlite.io/cmd/mocki/internal/parser/test_data": {
+					"github.com/kloudlite/api/cmd/mocki/internal/parser/test_data": {
 						Alias:       "test_data",
-						PackagePath: "kloudlite.io/cmd/mocki/internal/parser/test_data",
+						PackagePath: "github.com/kloudlite/api/cmd/mocki/internal/parser/test_data",
 					},
 				},
 				Implementations: []string{
@@ -129,7 +129,7 @@ func TestFindAndParseInterface(t *testing.T) {
 		{
 			name: "test 4: normal interface with methods having no named arguments",
 			args: args{
-				packagePath:   "kloudlite.io/cmd/mocki/internal/parser/test_data",
+				packagePath:   "github.com/kloudlite/api/cmd/mocki/internal/parser/test_data",
 				interfaceName: "Type4",
 			},
 			want: &parser.Info{
@@ -159,7 +159,7 @@ func TestFindAndParseInterface(t *testing.T) {
 		{
 			name: "test 5: interface with methods having no return values",
 			args: args{
-				packagePath:   "kloudlite.io/cmd/mocki/internal/parser/test_data",
+				packagePath:   "github.com/kloudlite/api/cmd/mocki/internal/parser/test_data",
 				interfaceName: "Type5",
 			},
 			want: &parser.Info{
@@ -194,7 +194,7 @@ func TestFindAndParseInterface(t *testing.T) {
 		{
 			name: "test 6: interface with methods having aliases imported types",
 			args: args{
-				packagePath:   "kloudlite.io/cmd/mocki/internal/parser/test_data",
+				packagePath:   "github.com/kloudlite/api/cmd/mocki/internal/parser/test_data",
 				interfaceName: "Type6",
 			},
 			want: &parser.Info{
@@ -225,7 +225,7 @@ func TestFindAndParseInterface(t *testing.T) {
 		{
 			name: "test 7: non existent interface, should throw error",
 			args: args{
-				packagePath:   "kloudlite.io/cmd/mocki/internal/parser/test_data",
+				packagePath:   "github.com/kloudlite/api/cmd/mocki/internal/parser/test_data",
 				interfaceName: "DoesNotExist",
 			},
 			want: &parser.Info{
diff --git a/flake.nix b/flake.nix
index 1118e30e2..a2f53dd39 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,28 +1,24 @@
 {
   description = "kloudlite api dev environment";
 
-  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-  };
-
+  inputs = { nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; }; 
   outputs = { self, nixpkgs, flake-utils }:
     flake-utils.lib.eachDefaultSystem (system:
       let
         pkgs = import nixpkgs { inherit system; };
       in
       {
-        packages = {
-          mocki = pkgs.writeScriptBin "mocki" ''
-            $PROJECT_ROOT/cmd/mocki/bin/mocki "$@"
-          '';
-          nats-manager = pkgs.writeScriptBin "nats-manager" ''
-            $PROJECT_ROOT/cmd/nats-manager/bin/nats-manager --url "nats://nats.kloudlite.svc.cluster.local:4222" --stream "resource-sync" "$@"
-          '';
-        };
+        packages.mocki = pkgs.writeScriptBin "mocki" ''
+          #! /usr/bin/env bash
+          $PROJECT_ROOT/cmd/mocki/bin/mocki "$@"
+        '';
+        packages.nats-manager = pkgs.writeScriptBin "nats-manager" ''
+          $PROJECT_ROOT/cmd/nats-manager/bin/nats-manager --url "nats://nats.kloudlite.svc.cluster.local:4222" --stream "resource-sync" "$@"
+        '';
         devShells.default = pkgs.mkShell {
           packages = [
             self.packages.${system}.mocki
-            self.packages.${system}.nats-manager
+            # self.packages.${system}.nats-manager
           ];
           hardeningDisable = [ "all" ];
           buildInputs = with pkgs; [
@@ -66,6 +62,7 @@
           ];
 
           shellHook = ''
+            # export PATH="$PWD/cmd/mocki/bin:$PATH"
             export PROJECT_ROOT="$PWD"
           '';
         };
diff --git a/mocks/grpc-interfaces/kloudlite.io/rpc/accounts/accountsclient.go b/mocks/grpc-interfaces/kloudlite.io/rpc/accounts/accountsclient.go
deleted file mode 100644
index 015cfd585..000000000
--- a/mocks/grpc-interfaces/kloudlite.io/rpc/accounts/accountsclient.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package mocks
-
-import (
-	context "context"
-	accounts "github.com/kloudlite/api/grpc-interfaces/kloudlite.io/rpc/accounts"
-	grpc "google.golang.org/grpc"
-)
-
-type AccountsClientCallerInfo struct {
-	Args []any
-}
-
-type AccountsClient struct {
-	Calls          map[string][]AccountsClientCallerInfo
-	MockGetAccount func(ctx context.Context, in *accounts.GetAccountIn, opts ...grpc.CallOption) (*accounts.GetAccountOut, error)
-}
-
-func (m *AccountsClient) registerCall(funcName string, args ...any) {
-	if m.Calls == nil {
-		m.Calls = map[string][]AccountsClientCallerInfo{}
-	}
-	m.Calls[funcName] = append(m.Calls[funcName], AccountsClientCallerInfo{Args: args})
-}
-
-func (aMock *AccountsClient) GetAccount(ctx context.Context, in *accounts.GetAccountIn, opts ...grpc.CallOption) (*accounts.GetAccountOut, error) {
-	if aMock.MockGetAccount != nil {
-		aMock.registerCall("GetAccount", ctx, in, opts)
-		return aMock.MockGetAccount(ctx, in, opts...)
-	}
-	panic("AccountsClient: method 'GetAccount' not implemented, yet")
-}
-
-func NewAccountsClient() *AccountsClient {
-	return &AccountsClient{}
-}
diff --git a/mocks/grpc-interfaces/kloudlite.io/rpc/iam/iamclient.go b/mocks/grpc-interfaces/kloudlite.io/rpc/iam/iamclient.go
deleted file mode 100644
index 578b62ed7..000000000
--- a/mocks/grpc-interfaces/kloudlite.io/rpc/iam/iamclient.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package mocks
-
-import (
-	context "context"
-	iam "github.com/kloudlite/api/grpc-interfaces/kloudlite.io/rpc/iam"
-	grpc "google.golang.org/grpc"
-)
-
-type IAMClientCallerInfo struct {
-	Args []any
-}
-
-type IAMClient struct {
-	Calls                          map[string][]IAMClientCallerInfo
-	MockAddMembership              func(ctx context.Context, in *iam.AddMembershipIn, opts ...grpc.CallOption) (*iam.AddMembershipOut, error)
-	MockCan                        func(ctx context.Context, in *iam.CanIn, opts ...grpc.CallOption) (*iam.CanOut, error)
-	MockGetMembership              func(ctx context.Context, in *iam.GetMembershipIn, opts ...grpc.CallOption) (*iam.GetMembershipOut, error)
-	MockListMembershipsForResource func(ctx context.Context, in *iam.MembershipsForResourceIn, opts ...grpc.CallOption) (*iam.ListMembershipsOut, error)
-	MockListMembershipsForUser     func(ctx context.Context, in *iam.MembershipsForUserIn, opts ...grpc.CallOption) (*iam.ListMembershipsOut, error)
-	MockPing                       func(ctx context.Context, in *iam.Message, opts ...grpc.CallOption) (*iam.Message, error)
-	MockRemoveMembership           func(ctx context.Context, in *iam.RemoveMembershipIn, opts ...grpc.CallOption) (*iam.RemoveMembershipOut, error)
-	MockRemoveResource             func(ctx context.Context, in *iam.RemoveResourceIn, opts ...grpc.CallOption) (*iam.RemoveResourceOut, error)
-	MockUpdateMembership           func(ctx context.Context, in *iam.UpdateMembershipIn, opts ...grpc.CallOption) (*iam.UpdateMembershipOut, error)
-}
-
-func (m *IAMClient) registerCall(funcName string, args ...any) {
-	if m.Calls == nil {
-		m.Calls = map[string][]IAMClientCallerInfo{}
-	}
-	m.Calls[funcName] = append(m.Calls[funcName], IAMClientCallerInfo{Args: args})
-}
-
-func (iMock *IAMClient) AddMembership(ctx context.Context, in *iam.AddMembershipIn, opts ...grpc.CallOption) (*iam.AddMembershipOut, error) {
-	if iMock.MockAddMembership != nil {
-		iMock.registerCall("AddMembership", ctx, in, opts)
-		return iMock.MockAddMembership(ctx, in, opts...)
-	}
-	panic("IAMClient: method 'AddMembership' not implemented, yet")
-}
-
-func (iMock *IAMClient) Can(ctx context.Context, in *iam.CanIn, opts ...grpc.CallOption) (*iam.CanOut, error) {
-	if iMock.MockCan != nil {
-		iMock.registerCall("Can", ctx, in, opts)
-		return iMock.MockCan(ctx, in, opts...)
-	}
-	panic("IAMClient: method 'Can' not implemented, yet")
-}
-
-func (iMock *IAMClient) GetMembership(ctx context.Context, in *iam.GetMembershipIn, opts ...grpc.CallOption) (*iam.GetMembershipOut, error) {
-	if iMock.MockGetMembership != nil {
-		iMock.registerCall("GetMembership", ctx, in, opts)
-		return iMock.MockGetMembership(ctx, in, opts...)
-	}
-	panic("IAMClient: method 'GetMembership' not implemented, yet")
-}
-
-func (iMock *IAMClient) ListMembershipsForResource(ctx context.Context, in *iam.MembershipsForResourceIn, opts ...grpc.CallOption) (*iam.ListMembershipsOut, error) {
-	if iMock.MockListMembershipsForResource != nil {
-		iMock.registerCall("ListMembershipsForResource", ctx, in, opts)
-		return iMock.MockListMembershipsForResource(ctx, in, opts...)
-	}
-	panic("IAMClient: method 'ListMembershipsForResource' not implemented, yet")
-}
-
-func (iMock *IAMClient) ListMembershipsForUser(ctx context.Context, in *iam.MembershipsForUserIn, opts ...grpc.CallOption) (*iam.ListMembershipsOut, error) {
-	if iMock.MockListMembershipsForUser != nil {
-		iMock.registerCall("ListMembershipsForUser", ctx, in, opts)
-		return iMock.MockListMembershipsForUser(ctx, in, opts...)
-	}
-	panic("IAMClient: method 'ListMembershipsForUser' not implemented, yet")
-}
-
-func (iMock *IAMClient) Ping(ctx context.Context, in *iam.Message, opts ...grpc.CallOption) (*iam.Message, error) {
-	if iMock.MockPing != nil {
-		iMock.registerCall("Ping", ctx, in, opts)
-		return iMock.MockPing(ctx, in, opts...)
-	}
-	panic("IAMClient: method 'Ping' not implemented, yet")
-}
-
-func (iMock *IAMClient) RemoveMembership(ctx context.Context, in *iam.RemoveMembershipIn, opts ...grpc.CallOption) (*iam.RemoveMembershipOut, error) {
-	if iMock.MockRemoveMembership != nil {
-		iMock.registerCall("RemoveMembership", ctx, in, opts)
-		return iMock.MockRemoveMembership(ctx, in, opts...)
-	}
-	panic("IAMClient: method 'RemoveMembership' not implemented, yet")
-}
-
-func (iMock *IAMClient) RemoveResource(ctx context.Context, in *iam.RemoveResourceIn, opts ...grpc.CallOption) (*iam.RemoveResourceOut, error) {
-	if iMock.MockRemoveResource != nil {
-		iMock.registerCall("RemoveResource", ctx, in, opts)
-		return iMock.MockRemoveResource(ctx, in, opts...)
-	}
-	panic("IAMClient: method 'RemoveResource' not implemented, yet")
-}
-
-func (iMock *IAMClient) UpdateMembership(ctx context.Context, in *iam.UpdateMembershipIn, opts ...grpc.CallOption) (*iam.UpdateMembershipOut, error) {
-	if iMock.MockUpdateMembership != nil {
-		iMock.registerCall("UpdateMembership", ctx, in, opts)
-		return iMock.MockUpdateMembership(ctx, in, opts...)
-	}
-	panic("IAMClient: method 'UpdateMembership' not implemented, yet")
-}
-
-func NewIAMClient() *IAMClient {
-	return &IAMClient{}
-}
diff --git a/mocks/grpc-interfaces/kloudlite.io/rpc/message-office-internal/messageofficeinternalclient.go b/mocks/grpc-interfaces/kloudlite.io/rpc/message-office-internal/messageofficeinternalclient.go
deleted file mode 100644
index 57f1b062f..000000000
--- a/mocks/grpc-interfaces/kloudlite.io/rpc/message-office-internal/messageofficeinternalclient.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package mocks
-
-import (
-	context "context"
-	message_office_internal "github.com/kloudlite/api/grpc-interfaces/kloudlite.io/rpc/message-office-internal"
-	grpc "google.golang.org/grpc"
-)
-
-type MessageOfficeInternalClientCallerInfo struct {
-	Args []any
-}
-
-type MessageOfficeInternalClient struct {
-	Calls                    map[string][]MessageOfficeInternalClientCallerInfo
-	MockGenerateClusterToken func(ctx context.Context, in *message_office_internal.GenerateClusterTokenIn, opts ...grpc.CallOption) (*message_office_internal.GenerateClusterTokenOut, error)
-}
-
-func (m *MessageOfficeInternalClient) registerCall(funcName string, args ...any) {
-	if m.Calls == nil {
-		m.Calls = map[string][]MessageOfficeInternalClientCallerInfo{}
-	}
-	m.Calls[funcName] = append(m.Calls[funcName], MessageOfficeInternalClientCallerInfo{Args: args})
-}
-
-func (mMock *MessageOfficeInternalClient) GenerateClusterToken(ctx context.Context, in *message_office_internal.GenerateClusterTokenIn, opts ...grpc.CallOption) (*message_office_internal.GenerateClusterTokenOut, error) {
-	if mMock.MockGenerateClusterToken != nil {
-		mMock.registerCall("GenerateClusterToken", ctx, in, opts)
-		return mMock.MockGenerateClusterToken(ctx, in, opts...)
-	}
-	panic("MessageOfficeInternalClient: method 'GenerateClusterToken' not implemented, yet")
-}
-
-func NewMessageOfficeInternalClient() *MessageOfficeInternalClient {
-	return &MessageOfficeInternalClient{}
-}
diff --git a/mocks/pkg/k8s/client.go b/mocks/pkg/k8s/client.go
deleted file mode 100644
index d30d86aa0..000000000
--- a/mocks/pkg/k8s/client.go
+++ /dev/null
@@ -1,62 +0,0 @@
-package mocks
-
-import (
-	context "context"
-	types "k8s.io/apimachinery/pkg/types"
-	client "sigs.k8s.io/controller-runtime/pkg/client"
-)
-
-type ClientCallerInfo struct {
-	Args []any
-}
-
-type Client struct {
-	Calls              map[string][]ClientCallerInfo
-	MockApplyYAML      func(ctx context.Context, yamls ...[]byte) error
-	MockDeleteYAML     func(ctx context.Context, yamls ...[]byte) error
-	MockGet            func(ctx context.Context, nn types.NamespacedName, obj client.Object) error
-	MockValidateObject func(ctx context.Context, obj client.Object) error
-}
-
-func (m *Client) registerCall(funcName string, args ...any) {
-	if m.Calls == nil {
-		m.Calls = map[string][]ClientCallerInfo{}
-	}
-	m.Calls[funcName] = append(m.Calls[funcName], ClientCallerInfo{Args: args})
-}
-
-func (cMock *Client) ApplyYAML(ctx context.Context, yamls ...[]byte) error {
-	if cMock.MockApplyYAML != nil {
-		cMock.registerCall("ApplyYAML", ctx, yamls)
-		return cMock.MockApplyYAML(ctx, yamls...)
-	}
-	panic("Client: method 'ApplyYAML' not implemented, yet")
-}
-
-func (cMock *Client) DeleteYAML(ctx context.Context, yamls ...[]byte) error {
-	if cMock.MockDeleteYAML != nil {
-		cMock.registerCall("DeleteYAML", ctx, yamls)
-		return cMock.MockDeleteYAML(ctx, yamls...)
-	}
-	panic("Client: method 'DeleteYAML' not implemented, yet")
-}
-
-func (cMock *Client) Get(ctx context.Context, nn types.NamespacedName, obj client.Object) error {
-	if cMock.MockGet != nil {
-		cMock.registerCall("Get", ctx, nn, obj)
-		return cMock.MockGet(ctx, nn, obj)
-	}
-	panic("Client: method 'Get' not implemented, yet")
-}
-
-func (cMock *Client) ValidateObject(ctx context.Context, obj client.Object) error {
-	if cMock.MockValidateObject != nil {
-		cMock.registerCall("ValidateObject", ctx, obj)
-		return cMock.MockValidateObject(ctx, obj)
-	}
-	panic("Client: method 'ValidateObject' not implemented, yet")
-}
-
-func NewClient() *Client {
-	return &Client{}
-}
diff --git a/mocks/pkg/repos/dbrepo.go b/mocks/pkg/repos/dbrepo.go
deleted file mode 100644
index e69de29bb..000000000