diff --git a/cluster/cert-manager.yaml b/cluster/archive/cert-manager.yaml
similarity index 100%
rename from cluster/cert-manager.yaml
rename to cluster/archive/cert-manager.yaml
diff --git a/cluster/cert-manager-appset.yaml b/cluster/cert-manager-appset.yaml
new file mode 100644
index 0000000..8bed9c0
--- /dev/null
+++ b/cluster/cert-manager-appset.yaml
@@ -0,0 +1,45 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: external-secrets-operator
+  namespace: openshift-gitops
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+  - clusters: {} # Variable is .name
+  template:
+    metadata:
+      name: '{{.name}}-external-secrets'
+      annotations:
+        argocd.argoproj.io/sync-wave: "2"
+    spec:
+      destination:
+        name: '{{.name}}'
+        namespace: cert-manager
+      project: default
+      source:
+        path: cluster/cert-manager
+        repoURL: https://github.com/rblundon/homelab.git
+        targetRevision: HEAD
+        helm:
+          valueFiles:
+            - values-'{{.name}}'.yaml
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - RespectIgnoreDifferences=true
+        - CreateNamespace=true
+        managedNamespaceMetadata:
+          labels:
+            argocd.argoproj.io/managed-by: openshift-gitops
+      ignoreDifferences:
+      - group: apps
+        kind: Deployment
+        jsonPointers:
+        - /spec/replicas
\ No newline at end of file
diff --git a/cluster/cert-manager/values-in-cluster.yaml b/cluster/cert-manager/values-in-cluster.yaml
new file mode 100644
index 0000000..ff68089
--- /dev/null
+++ b/cluster/cert-manager/values-in-cluster.yaml
@@ -0,0 +1,53 @@
+---
+# https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml
+
+cert-manager:
+  enabled: true
+  installCRDs: true
+  dns01RecursiveNameservers: 1.1.1.1:53
+  dns01RecursiveNameserversOnly: true
+  livenessProbe:
+    enabled: true
+  prometheus:
+    enabled: true
+    servicemonitor:
+      enabled: true
+
+ca:
+  enabled: false
+  tlsCrt: |-
+    -----BEGIN CERTIFICATE-----
+    <actual certificate>
+    -----END CERTIFICATE-----
+  tlsKey: |-
+    -----BEGIN PRIVATE KEY-----
+    <actual key>
+    -----END PRIVATE KEY-----
+
+le:
+  prod:
+    enabled: true
+    server: https://acme-v02.api.letsencrypt.org/directory
+  staging:
+    enabled: true
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+  apiCert:
+    enabled: true
+  routerCert:
+    enabled: true
+  preferredChain: ""
+  email: ryan.blundon@protonmail.com
+  solvers:
+  - type: dns
+    dnsConfig:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+    dnsZones:
+    - mk-labs.cloud
+
+cluster_name: hub
+base_domain: int.mk-labs.cloud
\ No newline at end of file
diff --git a/cluster/cert-manager/values-internal.yaml b/cluster/cert-manager/values-internal.yaml
new file mode 100644
index 0000000..ae06577
--- /dev/null
+++ b/cluster/cert-manager/values-internal.yaml
@@ -0,0 +1,53 @@
+---
+# https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml
+
+cert-manager:
+  enabled: true
+  installCRDs: true
+  dns01RecursiveNameservers: 1.1.1.1:53
+  dns01RecursiveNameserversOnly: true
+  livenessProbe:
+    enabled: true
+  prometheus:
+    enabled: true
+    servicemonitor:
+      enabled: true
+
+ca:
+  enabled: false
+  tlsCrt: |-
+    -----BEGIN CERTIFICATE-----
+    <actual certificate>
+    -----END CERTIFICATE-----
+  tlsKey: |-
+    -----BEGIN PRIVATE KEY-----
+    <actual key>
+    -----END PRIVATE KEY-----
+
+le:
+  prod:
+    enabled: true
+    server: https://acme-v02.api.letsencrypt.org/directory
+  staging:
+    enabled: true
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+  apiCert:
+    enabled: true
+  routerCert:
+    enabled: true
+  preferredChain: ""
+  email: ryan.blundon@protonmail.com
+  solvers:
+  - type: dns
+    dnsConfig:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+    dnsZones:
+    - mk-labs.cloud
+
+cluster_name: openshift
+base_domain: int.mk-labs.cloud
\ No newline at end of file
diff --git a/cluster/external-secrets-appset.yaml b/cluster/external-secrets-appset.yaml
index e39e37b..5a40088 100644
--- a/cluster/external-secrets-appset.yaml
+++ b/cluster/external-secrets-appset.yaml
@@ -4,15 +4,13 @@ kind: ApplicationSet
 metadata:
   name: external-secrets-operator
   namespace: openshift-gitops
-#  annotations:
-#    argocd.argoproj.io/sync-wave: "1"
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   goTemplate: true
   goTemplateOptions: ["missingkey=error"]
   generators:
-  - clusters: {}
+  - clusters: {} # Variable is .name
   template:
     metadata:
       name: '{{.name}}-external-secrets'
diff --git a/cluster/openshift-lightspeed-operator-appset.yaml b/cluster/openshift-lightspeed-operator-appset.yaml
index 936b40e..63251be 100644
--- a/cluster/openshift-lightspeed-operator-appset.yaml
+++ b/cluster/openshift-lightspeed-operator-appset.yaml
@@ -10,8 +10,8 @@ spec:
   goTemplate: true
   goTemplateOptions: ["missingkey=error"]
   generators:
-  # - clusters: {}
-  - list:
+  # - clusters: {} # Variable is .name
+  - list: # Variable is .cluster
       elements:
       - cluster: internal
   template: