@@ -17,18 +17,22 @@ limitations under the License.
 package apiserver
 
 import (
+	"context"
 	"fmt"
+	"time"
 
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/apiserver/pkg/registry/rest"
 	genericapiserver "k8s.io/apiserver/pkg/server"
-	"k8s.io/client-go/dynamic"
-	"k8s.io/client-go/kubernetes"
-	restclient "k8s.io/client-go/rest"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/cozystack/cozystack/pkg/apis/apps"
 	appsinstall "github.com/cozystack/cozystack/pkg/apis/apps/install"
@@ -50,6 +54,7 @@ var (
 	// versions and content types.
 	Codecs            = serializer.NewCodecFactory(Scheme)
 	CozyComponentName = "cozy"
+	syncPeriod        = 5 * time.Minute
 )
 
 func init() {
@@ -58,9 +63,15 @@ func init() {
 
 	// Register HelmRelease types.
 	if err := helmv2.AddToScheme(Scheme); err != nil {
-		panic(fmt.Sprintf("Failed to add HelmRelease types to scheme: %v", err))
+		panic(fmt.Errorf("Failed to add HelmRelease types to scheme: %w", err))
 	}
 
+	if err := corev1.AddToScheme(Scheme); err != nil {
+		panic(fmt.Errorf("Failed to add core types to scheme: %w", err))
+	}
+	if err := rbacv1.AddToScheme(Scheme); err != nil {
+		panic(fmt.Errorf("Failed to add RBAC types to scheme: %w", err))
+	}
 	// Add unversioned types.
 	metav1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
 
@@ -118,43 +129,59 @@ func (c completedConfig) New() (*CozyServer, error) {
 	}
 
 	// Create a dynamic client for HelmRelease using InClusterConfig.
-	inClusterConfig, err := restclient.InClusterConfig()
+	cfg, err := ctrl.GetConfig()
 	if err != nil {
-		return nil, fmt.Errorf("unable to get in-cluster config: %v", err)
+		return nil, fmt.Errorf("failed to get kubeconfig: %w", err)
 	}
 
-	dynamicClient, err := dynamic.NewForConfig(inClusterConfig)
+	mgr, err := ctrl.NewManager(cfg, ctrl.Options{
+		Scheme: Scheme,
+		Cache:  cache.Options{SyncPeriod: &syncPeriod},
+	})
 	if err != nil {
-		return nil, fmt.Errorf("unable to create dynamic client: %v", err)
+		return nil, fmt.Errorf("failed to build manager: %w", err)
 	}
 
-	clientset, err := kubernetes.NewForConfig(inClusterConfig)
-	if err != nil {
-		return nil, fmt.Errorf("create kube clientset: %v", err)
+	ctx := ctrl.SetupSignalHandler()
+
+	if err = mustGetInformers(ctx, mgr,
+		&helmv2.HelmRelease{},
+		&corev1.Secret{},
+		&corev1.Namespace{},
+		&corev1.Service{},
+		&rbacv1.RoleBinding{},
+	); err != nil {
+		return nil, fmt.Errorf("failed to get informers: %w", err)
+	}
+
+	go func() {
+		if err := mgr.Start(ctx); err != nil {
+			panic(fmt.Errorf("manager start failed: %w", err))
+		}
+	}()
+
+	if ok := mgr.GetCache().WaitForCacheSync(ctx); !ok {
+		return nil, fmt.Errorf("cache sync failed")
 	}
 
+	cli := mgr.GetClient()
+	watchCli, err := client.NewWithWatch(cfg, client.Options{Scheme: Scheme})
+	if err != nil {
+		return nil, fmt.Errorf("failed to build watch client: %w", err)
+	}
 	// --- static, cluster-scoped resource for core group ---
 	coreV1alpha1Storage := map[string]rest.Storage{}
 	coreV1alpha1Storage["tenantnamespaces"] = cozyregistry.RESTInPeace(
-		tenantnamespacestorage.NewREST(
-			clientset.CoreV1(),
-			clientset.RbacV1(),
-		),
+		tenantnamespacestorage.NewREST(cli, watchCli),
 	)
 	coreV1alpha1Storage["tenantsecrets"] = cozyregistry.RESTInPeace(
-		tenantsecretstorage.NewREST(
-			clientset.CoreV1(),
-		),
+		tenantsecretstorage.NewREST(cli, watchCli),
 	)
 	coreV1alpha1Storage["tenantsecretstables"] = cozyregistry.RESTInPeace(
-		tenantsecretstablestorage.NewREST(
-			clientset.CoreV1(),
-		),
+		tenantsecretstablestorage.NewREST(cli, watchCli),
 	)
 	coreV1alpha1Storage["tenantmodules"] = cozyregistry.RESTInPeace(
-		tenantmodulestorage.NewREST(
-			dynamicClient,
-		),
+		tenantmodulestorage.NewREST(cli, watchCli),
 	)
 
 	coreApiGroupInfo := genericapiserver.NewDefaultAPIGroupInfo(core.GroupName, Scheme, metav1.ParameterCodec, Codecs)
@@ -166,7 +193,7 @@ func (c completedConfig) New() (*CozyServer, error) {
 	// --- dynamically-configured, per-tenant resources ---
 	appsV1alpha1Storage := map[string]rest.Storage{}
 	for _, resConfig := range c.ResourceConfig.Resources {
-		storage := applicationstorage.NewREST(dynamicClient, &resConfig)
+		storage := applicationstorage.NewREST(cli, watchCli, &resConfig)
 		appsV1alpha1Storage[resConfig.Application.Plural] = cozyregistry.RESTInPeace(storage)
 	}
 	appsApiGroupInfo := genericapiserver.NewDefaultAPIGroupInfo(apps.GroupName, Scheme, metav1.ParameterCodec, Codecs)
@@ -177,3 +204,12 @@ func (c completedConfig) New() (*CozyServer, error) {
 
 	return s, nil
 }
+
+func mustGetInformers(ctx context.Context, mgr ctrl.Manager, types ...client.Object) error {
+	for i := range types {
+		if _, err := mgr.GetCache().GetInformer(ctx, types[i]); err != nil {
+			return fmt.Errorf("failed to get informer for %T: %w", types[i], err)
+		}
+	}
+	return nil
+}