diff --git a/packages/kontinuous/package.json b/packages/kontinuous/package.json
index 533ffd28b5..f0bbed1dd9 100644
--- a/packages/kontinuous/package.json
+++ b/packages/kontinuous/package.json
@@ -48,7 +48,7 @@
     "node": "^16.17 || ^18 || ^20"
   },
   "scripts": {
-    "test": "NODE_OPTIONS=\"--experimental-vm-modules --no-warnings\" jest tests",
+    "test": "NODE_OPTIONS=\"--experimental-vm-modules --no-warnings\" jest tests --detectOpenHandles --forceExit",
     "test:debug": "DEBUG=1 yarn test",
     "test:update-snapshots": "yarn test -u",
     "postinstall": "link-module-alias",
diff --git a/packages/kontinuous/tests/__snapshots__/extends-ovh.dev.yaml b/packages/kontinuous/tests/__snapshots__/extends-ovh.dev.yaml
index 61b05d8666..c5152ec84c 100644
--- a/packages/kontinuous/tests/__snapshots__/extends-ovh.dev.yaml
+++ b/packages/kontinuous/tests/__snapshots__/extends-ovh.dev.yaml
@@ -449,7 +449,7 @@ spec:
                         - app
                 topologyKey: kubernetes.io/hostname
       containers:
-        - image: harbor.fabrique.social.gouv.fr/test-extends-ovh/app:sha-ffac537e6cbbf934b08745a378932722df287a53
+        - image: harbor.fabrique.social.gouv.fr/fabrique/test-extends-ovh/app:sha-ffac537e6cbbf934b08745a378932722df287a53
           name: app
           ports:
             - containerPort: 3000
@@ -557,10 +557,10 @@ kind: Cluster
 metadata:
   name: pg-hasura
   labels:
-    helm.sh/chart: cnpg-cluster-1.8.0
+    helm.sh/chart: cnpg-cluster-1.9.1
     app.kubernetes.io/name: pg-hasura
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: 14.5-6
+    app.kubernetes.io/version: \\"15\\"
     app.kubernetes.io/managed-by: Helm
     kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
     kontinuous/deployment.env: test-extends-ovh-feature-branch-1
@@ -571,6 +571,7 @@ metadata:
     app.kubernetes.io/manifest-managed-by: kontinuous
     app.kubernetes.io/manifest-created-by: kontinuous
   annotations:
+    app.kubernetes.io/managed-by: Helm
     kontinuous/chartPath: project.fabrique.pg-hasura.cnpg-cluster
     kontinuous/source: project/charts/fabrique/charts/pg-hasura/charts/cnpg-cluster/templates/cluster.cnpg.yaml
     kontinuous/plugin.needs: |
@@ -619,10 +620,10 @@ kind: Cluster
 metadata:
   name: pg-keycloak
   labels:
-    helm.sh/chart: cnpg-cluster-1.8.0
+    helm.sh/chart: cnpg-cluster-1.9.1
     app.kubernetes.io/name: pg-keycloak
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: 14.5-6
+    app.kubernetes.io/version: \\"15\\"
     app.kubernetes.io/managed-by: Helm
     kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
     kontinuous/deployment.env: test-extends-ovh-feature-branch-1
@@ -633,6 +634,7 @@ metadata:
     app.kubernetes.io/manifest-managed-by: kontinuous
     app.kubernetes.io/manifest-created-by: kontinuous
   annotations:
+    app.kubernetes.io/managed-by: Helm
     kontinuous/chartPath: project.fabrique.pg-keycloak.cnpg-cluster
     kontinuous/source: project/charts/fabrique/charts/pg-keycloak/charts/cnpg-cluster/templates/cluster.cnpg.yaml
     kontinuous/plugin.needs: |
@@ -681,10 +683,10 @@ kind: Pooler
 metadata:
   name: pg-hasura-rw
   labels:
-    helm.sh/chart: cnpg-cluster-1.8.0
+    helm.sh/chart: cnpg-cluster-1.9.1
     app.kubernetes.io/name: pg-hasura
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: 14.5-6
+    app.kubernetes.io/version: \\"15\\"
     app.kubernetes.io/managed-by: Helm
     kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
     kontinuous/deployment.env: test-extends-ovh-feature-branch-1
@@ -716,10 +718,10 @@ kind: Pooler
 metadata:
   name: pg-keycloak-rw
   labels:
-    helm.sh/chart: cnpg-cluster-1.8.0
+    helm.sh/chart: cnpg-cluster-1.9.1
     app.kubernetes.io/name: pg-keycloak
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: 14.5-6
+    app.kubernetes.io/version: \\"15\\"
     app.kubernetes.io/managed-by: Helm
     kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
     kontinuous/deployment.env: test-extends-ovh-feature-branch-1
diff --git a/packages/kontinuous/tests/__snapshots__/extends-ovh.prod.yaml b/packages/kontinuous/tests/__snapshots__/extends-ovh.prod.yaml
index 00890ce84b..e2cd3aaf69 100644
--- a/packages/kontinuous/tests/__snapshots__/extends-ovh.prod.yaml
+++ b/packages/kontinuous/tests/__snapshots__/extends-ovh.prod.yaml
@@ -447,7 +447,7 @@ spec:
                         - app
                 topologyKey: kubernetes.io/hostname
       containers:
-        - image: harbor.fabrique.social.gouv.fr/test-extends-ovh/app:prod
+        - image: harbor.fabrique.social.gouv.fr/fabrique/test-extends-ovh/app:prod
           name: app
           ports:
             - containerPort: 3000
@@ -558,10 +558,10 @@ kind: Cluster
 metadata:
   name: pg-hasura
   labels:
-    helm.sh/chart: cnpg-cluster-1.8.0
+    helm.sh/chart: cnpg-cluster-1.9.1
     app.kubernetes.io/name: pg-hasura
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: 14.5-6
+    app.kubernetes.io/version: \\"15\\"
     app.kubernetes.io/managed-by: Helm
     kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
     kontinuous/deployment.env: test-extends-ovh-prod
@@ -572,6 +572,7 @@ metadata:
     app.kubernetes.io/manifest-managed-by: kontinuous
     app.kubernetes.io/manifest-created-by: kontinuous
   annotations:
+    app.kubernetes.io/managed-by: Helm
     kontinuous/chartPath: project.fabrique.pg-hasura.cnpg-cluster
     kontinuous/source: project/charts/fabrique/charts/pg-hasura/charts/cnpg-cluster/templates/cluster.cnpg.yaml
     kontinuous/plugin.needs: |
@@ -588,12 +589,27 @@ metadata:
     kontinuous/plugin.log: \\"false\\"
   namespace: test-extends-ovh
 spec:
-  instances: 1
+  instances: 3
   imageName: ghcr.io/cloudnative-pg/postgis:14
   imagePullPolicy: IfNotPresent
   storage:
     size: 8Gi
     storageClass: managed-csi
+  backup:
+    retentionPolicy: 60d
+    barmanObjectStore:
+      destinationPath: s3://fabrique-prod/test-extends-ovh
+      endpointURL: https://s3.gra.io.cloud.ovh.net
+      s3Credentials:
+        accessKeyId:
+          key: bucket_access_key
+          name: fabrique-prod-backups-access-key
+        region:
+          key: bucket_region
+          name: fabrique-prod-backups-access-key
+        secretAccessKey:
+          key: bucket_secret_key
+          name: fabrique-prod-backups-access-key
   minSyncReplicas: 0
   maxSyncReplicas: 0
   postgresql: {}
@@ -620,10 +636,10 @@ kind: Cluster
 metadata:
   name: pg-keycloak
   labels:
-    helm.sh/chart: cnpg-cluster-1.8.0
+    helm.sh/chart: cnpg-cluster-1.9.1
     app.kubernetes.io/name: pg-keycloak
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: 14.5-6
+    app.kubernetes.io/version: \\"15\\"
     app.kubernetes.io/managed-by: Helm
     kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
     kontinuous/deployment.env: test-extends-ovh-prod
@@ -634,6 +650,7 @@ metadata:
     app.kubernetes.io/manifest-managed-by: kontinuous
     app.kubernetes.io/manifest-created-by: kontinuous
   annotations:
+    app.kubernetes.io/managed-by: Helm
     kontinuous/chartPath: project.fabrique.pg-keycloak.cnpg-cluster
     kontinuous/source: project/charts/fabrique/charts/pg-keycloak/charts/cnpg-cluster/templates/cluster.cnpg.yaml
     kontinuous/plugin.needs: |
@@ -650,12 +667,27 @@ metadata:
     kontinuous/plugin.log: \\"false\\"
   namespace: test-extends-ovh
 spec:
-  instances: 1
+  instances: 3
   imageName: ghcr.io/cloudnative-pg/postgis:14
   imagePullPolicy: IfNotPresent
   storage:
     size: 8Gi
     storageClass: managed-csi
+  backup:
+    retentionPolicy: 60d
+    barmanObjectStore:
+      destinationPath: s3://fabrique-prod/test-extends-ovh
+      endpointURL: https://s3.gra.io.cloud.ovh.net
+      s3Credentials:
+        accessKeyId:
+          key: bucket_access_key
+          name: fabrique-prod-backups-access-key
+        region:
+          key: bucket_region
+          name: fabrique-prod-backups-access-key
+        secretAccessKey:
+          key: bucket_secret_key
+          name: fabrique-prod-backups-access-key
   minSyncReplicas: 0
   maxSyncReplicas: 0
   postgresql: {}
@@ -736,10 +768,10 @@ kind: Pooler
 metadata:
   name: pg-hasura-rw
   labels:
-    helm.sh/chart: cnpg-cluster-1.8.0
+    helm.sh/chart: cnpg-cluster-1.9.1
     app.kubernetes.io/name: pg-hasura
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: 14.5-6
+    app.kubernetes.io/version: \\"15\\"
     app.kubernetes.io/managed-by: Helm
     kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
     kontinuous/deployment.env: test-extends-ovh-prod
@@ -771,10 +803,10 @@ kind: Pooler
 metadata:
   name: pg-keycloak-rw
   labels:
-    helm.sh/chart: cnpg-cluster-1.8.0
+    helm.sh/chart: cnpg-cluster-1.9.1
     app.kubernetes.io/name: pg-keycloak
     app.kubernetes.io/instance: release-name
-    app.kubernetes.io/version: 14.5-6
+    app.kubernetes.io/version: \\"15\\"
     app.kubernetes.io/managed-by: Helm
     kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
     kontinuous/deployment.env: test-extends-ovh-prod
@@ -800,5 +832,67 @@ spec:
       max_client_conn: \\"1000\\"
     poolMode: session
   type: rw
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-hasura-scheduledbackup
+  labels:
+    helm.sh/chart: cnpg-cluster-1.9.1
+    app.kubernetes.io/name: pg-hasura
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: \\"15\\"
+    app.kubernetes.io/managed-by: Helm
+    kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
+    kontinuous/deployment.env: test-extends-ovh-prod
+    kontinuous/ref: feature-branch-1
+    kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/resourceName: scheduledbackup-pg-hasura-scheduledbackup-1vyq5go6
+    app.kubernetes.io/manifest-managed-by: kontinuous
+    app.kubernetes.io/manifest-created-by: kontinuous
+  annotations:
+    kontinuous/chartPath: project.fabrique.pg-hasura.cnpg-cluster
+    kontinuous/source: project/charts/fabrique/charts/pg-hasura/charts/cnpg-cluster/templates/scheduledbackup.cnpg.yaml
+    kontinuous/plugin.needs: |
+      - project.fabrique.pg-hasura.jobs-pg
+    kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
+  namespace: test-extends-ovh
+spec:
+  backupOwnerReference: self
+  cluster:
+    name: pg-hasura
+  schedule: 0 0 0 * * *
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-keycloak-scheduledbackup
+  labels:
+    helm.sh/chart: cnpg-cluster-1.9.1
+    app.kubernetes.io/name: pg-keycloak
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: \\"15\\"
+    app.kubernetes.io/managed-by: Helm
+    kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
+    kontinuous/deployment.env: test-extends-ovh-prod
+    kontinuous/ref: feature-branch-1
+    kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/resourceName: scheduledbackup-pg-keycloak-scheduledbackup-3iywftai
+    app.kubernetes.io/manifest-managed-by: kontinuous
+    app.kubernetes.io/manifest-created-by: kontinuous
+  annotations:
+    kontinuous/chartPath: project.fabrique.pg-keycloak.cnpg-cluster
+    kontinuous/source: project/charts/fabrique/charts/pg-keycloak/charts/cnpg-cluster/templates/scheduledbackup.cnpg.yaml
+    kontinuous/plugin.needs: |
+      - project.fabrique.pg-keycloak.jobs-pg
+    kontinuous/deployment: test-extends-ovh-feature-branch-1-ffac537e6cbbf934b08-5oa7s3iv
+  namespace: test-extends-ovh
+spec:
+  backupOwnerReference: self
+  cluster:
+    name: pg-keycloak
+  schedule: 0 0 0 * * *
 "
 `;
diff --git a/packages/kontinuous/tests/__snapshots__/override-env-default.dev.yaml b/packages/kontinuous/tests/__snapshots__/override-env-default.dev.yaml
new file mode 100644
index 0000000000..1e078e1260
--- /dev/null
+++ b/packages/kontinuous/tests/__snapshots__/override-env-default.dev.yaml
@@ -0,0 +1,375 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`test build manifests with snapshots override-env-default.dev 1`] = `
+"apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    field.cattle.io/projectId: \\"1234\\"
+    kontinuous/gitBranch: feature-branch-1
+    kontinuous/mainNamespace: \\"true\\"
+    kapp.k14s.io/exists: \\"\\"
+    kontinuous/chartPath: project.fabrique.contrib.rancher-namespace
+    kontinuous/source: project/charts/fabrique/charts/contrib/charts/rancher-namespace/templates/namespace.yaml
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    janitor/ttl: 7d
+  labels:
+    application: test-override-env-default
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    kontinuous/deployment.env: test-override-env-default-feature-branch-1
+    kontinuous/ref: feature-branch-1
+    kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/resourceName: namespace-test-override-env-default-feature-branch-1-23780fnk
+    app.kubernetes.io/manifest-managed-by: kontinuous
+    app.kubernetes.io/manifest-created-by: kontinuous
+  name: test-override-env-default-feature-branch-1
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: netpol-ingress
+  namespace: test-override-env-default-feature-branch-1
+  annotations:
+    kontinuous/chartPath: project.fabrique.contrib.security-policies
+    kontinuous/source: project/charts/fabrique/charts/contrib/charts/security-policies/templates/network-policy.yml
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+  labels:
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    kontinuous/deployment.env: test-override-env-default-feature-branch-1
+    kontinuous/ref: feature-branch-1
+    kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/resourceName: networkpolicy-netpol-ingress-61ndxljw
+    app.kubernetes.io/manifest-managed-by: kontinuous
+    app.kubernetes.io/manifest-created-by: kontinuous
+spec:
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              network-policy/source: ingress-controller
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              network-policy/source: monitoring
+  podSelector: {}
+  policyTypes:
+    - Ingress
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: default
+  annotations:
+    kontinuous/chartPath: project.fabrique.contrib.security-policies
+    kontinuous/source: project/charts/fabrique/charts/contrib/charts/security-policies/templates/service-account.yaml
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+  labels:
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    kontinuous/deployment.env: test-override-env-default-feature-branch-1
+    kontinuous/ref: feature-branch-1
+    kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/resourceName: serviceaccount-default-2g5dmk74
+    app.kubernetes.io/manifest-managed-by: kontinuous
+    app.kubernetes.io/manifest-created-by: kontinuous
+  namespace: test-override-env-default-feature-branch-1
+automountServiceAccountToken: false
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: job-dev-test-override-env-default-feature-branch-1-cr-2l6fzsi6
+  namespace: test-override-env-default-feature-branch-1
+  annotations:
+    kontinuous/needsName: create-secrets.create-secrets
+    kontinuous/needsNames: '[\\"create-secrets\\",\\"create-secrets.create-secrets\\",\\"create-secrets..create-secrets\\"]'
+    janitor/ttl: 7d
+    kontinuous/chartPath: project.fabrique.pg.jobs-pg
+    kontinuous/source: project/charts/fabrique/charts/pg/charts/jobs-pg/templates/jobs.yaml
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    kontinuous/depname.full: project.fabrique.pg.jobs-pg.job.job-dev-test-override-env-default-feature-branch-1-cr-2l6fzsi6
+    kontinuous/depname.chartResource: jobs-pg.job.job-dev-test-override-env-default-feature-branch-1-cr-2l6fzsi6
+    kontinuous/depname.chartName: jobs-pg
+    kontinuous/depname.chartPath: project.fabrique.pg.jobs-pg
+    kontinuous/depname.resourcePath: job.job-dev-test-override-env-default-feature-branch-1-cr-2l6fzsi6
+    kontinuous/depname.resourceName: job-dev-test-override-env-default-feature-branch-1-cr-2l6fzsi6
+    kontinuous/depname.chartNameTopFull: pg.jobs-pg
+    kontinuous/depname.chartNameTop: pg
+    kontinuous/plugin.log: \\"true\\"
+  labels:
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    kontinuous/deployment.env: test-override-env-default-feature-branch-1
+    kontinuous/ref: feature-branch-1
+    kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/resourceName: job-job-dev-test-override-env-default-feature-branch-48ey1316
+    app.kubernetes.io/manifest-managed-by: kontinuous
+    app.kubernetes.io/manifest-created-by: kontinuous
+spec:
+  backoffLimit: 6
+  activeDeadlineSeconds: 3600
+  ttlSecondsAfterFinished: 1800
+  template:
+    metadata:
+      labels:
+        environment: dev
+        ref: feature-branch-1
+        repository: test-override-env-default
+        runName: cnpg-create-secrets
+        kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+        kontinuous/deployment.env: test-override-env-default-feature-branch-1
+        kontinuous/ref: feature-branch-1
+        kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+        kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+        kontinuous/resourceName: job-job-dev-test-override-env-default-feature-branch-48ey1316
+        app.kubernetes.io/manifest-managed-by: kontinuous
+        app.kubernetes.io/manifest-created-by: kontinuous
+      annotations:
+        kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    spec:
+      restartPolicy: Never
+      initContainers:
+        - name: degit-action
+          image: ghcr.io/socialgouv/kontinuous/degit:v1.161.9
+          command:
+            - sh
+            - -c
+            - degit --disable-cache
+              socialgouv/kontinuous/plugins/contrib/jobs/cnpg-create-secrets
+              /action
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+          volumeMounts:
+            - name: action
+              mountPath: /action
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 1024Mi
+            requests:
+              cpu: \\"0\\"
+              memory: \\"0\\"
+      containers:
+        - name: job
+          image: bitnami/kubectl:latest
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: APP_DB_SECRET_NAME
+              value: pg-app
+            - name: CNPG_DB_SECRET_NAME
+              value: pg-db
+            - name: HBA_DATABASE
+              value: \\"*\\"
+            - name: HBA_HOST
+              value: pg-rw
+            - name: HBA_USER
+              value: \\"*\\"
+            - name: NAMESPACE
+              value: test-override-env-default-feature-branch-1
+            - name: PGDATABASE
+              value: autodevops_feature-branch-1
+            - name: PGHOST
+              value: pg-rw
+            - name: PGPORT
+              value: \\"5432\\"
+            - name: PGUSER
+              value: user_feature-branch-1
+            - name: KUBECONFIG
+              value: /secrets/k8s/kubeconfig
+            - name: KONTINUOUS_OUTPUT
+              value: /kontinuous-output
+            - name: KONTINUOUS_INPUT
+              value: /kontinuous-input
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -e
+              /action/create-secrets.sh
+          resources:
+            limits:
+              cpu: 1
+              memory: 1Gi
+            requests:
+              cpu: 81m
+              memory: 262Mi
+          securityContext:
+            runAsUser: 1001
+            runAsGroup: 1001
+          volumeMounts:
+            - name: workspace
+              mountPath: /workspace
+            - name: action
+              mountPath: /action
+            - name: kubeconfig
+              mountPath: /secrets/k8s
+              readOnly: true
+            - name: kontinuous-io
+              mountPath: /kontinuous-output
+              subPath: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy/jobs-pg.create-secrets.create-secrets
+      securityContext:
+        fsGroup: 1001
+      volumes:
+        - name: workspace
+          emptyDir: {}
+        - name: action
+          emptyDir: {}
+        - name: kubeconfig
+          secret:
+            secretName: kubeconfig
+            items:
+              - key: KUBECONFIG
+                path: kubeconfig
+        - name: kontinuous-io
+          emptyDir: {}
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pg
+  labels:
+    helm.sh/chart: cnpg-cluster-1.9.1
+    app.kubernetes.io/name: pg
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: \\"15\\"
+    app.kubernetes.io/managed-by: Helm
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    kontinuous/deployment.env: test-override-env-default-feature-branch-1
+    kontinuous/ref: feature-branch-1
+    kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/resourceName: cluster-pg-251tk6jn
+    app.kubernetes.io/manifest-managed-by: kontinuous
+    app.kubernetes.io/manifest-created-by: kontinuous
+  annotations:
+    app.kubernetes.io/managed-by: Helm
+    kontinuous/chartPath: project.fabrique.pg.cnpg-cluster
+    kontinuous/source: project/charts/fabrique/charts/pg/charts/cnpg-cluster/templates/cluster.cnpg.yaml
+    kontinuous/plugin.needs: |
+      - project.fabrique.pg.jobs-pg
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    kontinuous/depname.full: project.fabrique.pg.cnpg-cluster.cluster.pg
+    kontinuous/depname.chartResource: cnpg-cluster.cluster.pg
+    kontinuous/depname.chartName: cnpg-cluster
+    kontinuous/depname.chartPath: project.fabrique.pg.cnpg-cluster
+    kontinuous/depname.resourcePath: cluster.pg
+    kontinuous/depname.resourceName: pg
+    kontinuous/depname.chartNameTopFull: pg.cnpg-cluster
+    kontinuous/depname.chartNameTop: pg
+    kontinuous/plugin.log: \\"false\\"
+  namespace: test-override-env-default-feature-branch-1
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgis:14
+  imagePullPolicy: IfNotPresent
+  storage:
+    size: 8Gi
+    storageClass: csi-cinder-high-speed
+  backup:
+    retentionPolicy: 60d
+    barmanObjectStore:
+      destinationPath: s3://fabrique-dev/test-override-env-default-feature-branch-1
+      endpointURL: https://s3.gra.io.cloud.ovh.net
+      s3Credentials:
+        accessKeyId:
+          key: bucket_access_key
+          name: fabrique-dev-backups-access-key
+        region:
+          key: bucket_region
+          name: fabrique-dev-backups-access-key
+        secretAccessKey:
+          key: bucket_secret_key
+          name: fabrique-dev-backups-access-key
+  minSyncReplicas: 0
+  maxSyncReplicas: 0
+  postgresql: {}
+  monitoring:
+    enablePodMonitor: false
+  bootstrap:
+    initdb:
+      database: autodevops_feature-branch-1
+      owner: user_feature-branch-1
+      secret:
+        name: pg-db
+      postInitTemplateSQL:
+        - CREATE EXTENSION IF NOT EXISTS \\"postgis\\";
+        - CREATE EXTENSION IF NOT EXISTS \\"postgis_topology\\";
+        - CREATE EXTENSION IF NOT EXISTS \\"fuzzystrmatch\\";
+        - CREATE EXTENSION IF NOT EXISTS \\"postgis_tiger_geocoder\\";
+        - CREATE EXTENSION IF NOT EXISTS \\"uuid-ossp\\";
+        - CREATE EXTENSION IF NOT EXISTS \\"citext\\";
+        - CREATE EXTENSION IF NOT EXISTS \\"pgcrypto\\";
+        - CREATE EXTENSION IF NOT EXISTS \\"hstore\\";
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: pg-rw
+  labels:
+    helm.sh/chart: cnpg-cluster-1.9.1
+    app.kubernetes.io/name: pg
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: \\"15\\"
+    app.kubernetes.io/managed-by: Helm
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    kontinuous/deployment.env: test-override-env-default-feature-branch-1
+    kontinuous/ref: feature-branch-1
+    kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/resourceName: pooler-pg-rw-16g3zl77
+    app.kubernetes.io/manifest-managed-by: kontinuous
+    app.kubernetes.io/manifest-created-by: kontinuous
+  annotations:
+    kontinuous/chartPath: project.fabrique.pg.cnpg-cluster
+    kontinuous/source: project/charts/fabrique/charts/pg/charts/cnpg-cluster/templates/pooler.cnpg.yaml
+    kontinuous/plugin.needs: |
+      - project.fabrique.pg.jobs-pg
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+  namespace: test-override-env-default-feature-branch-1
+spec:
+  cluster:
+    name: pg
+  instances: 1
+  pgbouncer:
+    parameters:
+      max_client_conn: \\"1000\\"
+    poolMode: session
+  type: rw
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-scheduledbackup
+  labels:
+    helm.sh/chart: cnpg-cluster-1.9.1
+    app.kubernetes.io/name: pg
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: \\"15\\"
+    app.kubernetes.io/managed-by: Helm
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+    kontinuous/deployment.env: test-override-env-default-feature-branch-1
+    kontinuous/ref: feature-branch-1
+    kontinuous/gitSha: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/appVersion: ffac537e6cbbf934b08745a378932722df287a53
+    kontinuous/resourceName: scheduledbackup-pg-scheduledbackup-4p1q206g
+    app.kubernetes.io/manifest-managed-by: kontinuous
+    app.kubernetes.io/manifest-created-by: kontinuous
+  annotations:
+    kontinuous/chartPath: project.fabrique.pg.cnpg-cluster
+    kontinuous/source: project/charts/fabrique/charts/pg/charts/cnpg-cluster/templates/scheduledbackup.cnpg.yaml
+    kontinuous/plugin.needs: |
+      - project.fabrique.pg.jobs-pg
+    kontinuous/deployment: test-override-env-default-feature-branch-1-ffac537e6c-tw0tuagy
+  namespace: test-override-env-default-feature-branch-1
+spec:
+  backupOwnerReference: self
+  cluster:
+    name: pg
+  schedule: 0 0 0 * * *
+"
+`;
diff --git a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/Chart.yaml b/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/Chart.yaml
deleted file mode 100644
index 05335bf791..0000000000
--- a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/Chart.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v2
-name: cnpg-cluster
-description: A Helm chart to create cloudnative-pg.io clusters
-type: application
-version: 1.8.0
-appVersion: 14.5-6
diff --git a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/_helpers.tpl b/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/_helpers.tpl
deleted file mode 100644
index 868ba1cd37..0000000000
--- a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/_helpers.tpl
+++ /dev/null
@@ -1,58 +0,0 @@
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "cnpg-cluster.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "cnpg-cluster.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "cnpg-cluster.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "cnpg-cluster.labels" -}}
-helm.sh/chart: {{ include "cnpg-cluster.chart" . }}
-{{ include "cnpg-cluster.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "cnpg-cluster.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "cnpg-cluster.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Backup secret name
-*/}}
-{{- define "cnpg-cluster.backupSecretName" -}}
-{{ or .Values.backup.secretName (print (include "cnpg-cluster.fullname" .) `-backup`) }}
-{{- end }}
diff --git a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/backup.secret.yaml b/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/backup.secret.yaml
deleted file mode 100644
index 5fd57e3a49..0000000000
--- a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/backup.secret.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-{{- if and .Values.backup.enabled .Values.backup.createSecret }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "cnpg-cluster.backupSecretName" . }}
-  labels:
-    {{- include "cnpg-cluster.labels" . | nindent 4 }}
-type: opaque
-data:
-{{- if .Values.backup.s3Credentials }}
-  {{- with .Values.backup.s3Credentials.accessKeyId }}
-  accessKeyId: {{ . | b64enc }}
-  {{- end }}
-  {{- with .Values.backup.s3Credentials.secretAccessKey }}
-  secretAccessKey: {{ . | b64enc }}
-  {{- end }}
-  {{- with .Values.backup.s3Credentials.region }}
-  region: {{ . | b64enc }}
-  {{- end }}
-  {{- with .Values.backup.s3Credentials.sessionToken }}
-  sessionToken: {{ . | b64enc }}
-  {{- end }}
-{{- else if .Values.backup.googleCredentials }}
-  {{- with .Values.backup.googleCredentials.applicationCredentials }}
-  applicationCredentials: {{ . | b64enc }}
-  {{- end }}
-{{- else if .Values.backup.azureCredentials  }}
-  {{- with .Values.backup.azureCredentials.connectionString }}
-  connectionString: {{ . | b64enc }}
-  {{- end }}
-  {{- with .Values.backup.azureCredentials.storageAccount }}
-  storageAccount: {{ . | b64enc }}
-  {{- end }}
-  {{- with .Values.backup.azureCredentials.storageKey }}
-  storageKey: {{ . | b64enc }}
-  {{- end }}
-  {{- with .Values.backup.azureCredentials.storageSasToken }}
-  storageSasToken: {{ . | b64enc }}
-  {{- end }}
-{{- else }}
-{{- end }}
-{{- end }}
diff --git a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/cluster.cnpg.yaml b/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/cluster.cnpg.yaml
deleted file mode 100644
index 22eb8d9990..0000000000
--- a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/cluster.cnpg.yaml
+++ /dev/null
@@ -1,204 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: {{ include "cnpg-cluster.fullname" . }}
-  labels:
-    {{- include "cnpg-cluster.labels" . | nindent 4 }}
-spec:
-  instances: {{ .Values.replicaCount }}
-  {{- if .Values.image.repository }}
-  imageName: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-  {{- end }}
-  imagePullPolicy: {{ .Values.image.pullPolicy }}
-  {{- if or .Values.imagePullSecrets .Values.registryCredentials }}
-  imagePullSecrets:
-  {{- with .Values.imagePullSecrets }}
-    {{- toYaml . | nindent 8 }}
-  {{- end }}
-  {{- range $name, $settings := .Values.registryCredentials }}
-    - name: "{{ include "cnpg-cluster.fullname" $ }}-{{ $name }}"
-  {{- end }}
-  {{- end }}
-
-  {{- if or .Values.nodeSelector .Values.tolerations .Values.extraAffinity }}
-  affinity:
-    {{- with .Values.nodeSelector }}
-    nodeSelector:
-      {{- toYaml . | nindent 6 }}
-    {{- end }}
-    {{- with .Values.tolerations }}
-    tolerations:
-      {{- toYaml . | nindent 6 }}
-    {{- end }}
-    {{- with .Values.extraAffinity }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- end }}
-
-  storage:
-    size: {{ .Values.persistence.size | quote }}
-    {{- with .Values.persistence.resizeInUseVolumes }}
-    resizeInUseVolumes: {{ . | quote }}
-    {{- end }}
-    {{- if .Values.persistence.storageClass }}
-    {{- if (eq "-" .Values.persistence.storageClass) }}
-    storageClass: ""
-    {{- else }}
-    storageClass: "{{ .Values.persistence.storageClass }}"
-    {{- end }}
-    {{- end }}
-    {{- with .Values.persistence.pvcTemplate }}
-    pvcTemplate:
-      {{- toYaml . | nindent 6 }}
-    {{- end }}
-
-{{- if .Values.backup.enabled }}
-  backup:
-    retentionPolicy: "{{ .Values.backup.retentionPolicy }}"
-    barmanObjectStore:
-    {{- with .Values.backup.endpointURL }}
-      endpointURL: "{{ . }}"
-    {{- end }}
-    {{- with .Values.backup.endpointCA }}
-      endpointCA: "{{ . }}"
-    {{- end }}
-      destinationPath: {{ .Values.backup.destinationPath }}
-    {{- with .Values.backup.serverName }}
-      serverName: "{{ . }}"
-    {{- end }}
-    {{- with .Values.backup.wal }}
-      wal:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- with .Values.backup.data }}
-      data:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- with .Values.backup.tags }}
-      tags:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- with .Values.backup.historyTags }}
-      historyTags:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- if .Values.backup.s3Credentials }}
-      s3Credentials:
-        {{- with .Values.backup.s3Credentials.accessKeyId }}
-        accessKeyId:
-          name: {{ include "cnpg-cluster.backupSecretName" $ }}
-          key: "accessKeyId"
-        {{- end }}
-        {{- with .Values.backup.s3Credentials.secretAccessKey }}
-        secretAccessKey:
-          name: {{ include "cnpg-cluster.backupSecretName" $ }}
-          key: "secretAccessKey"
-        {{- end }}
-        {{- with .Values.backup.s3Credentials.region }}
-        region:
-          name: {{ include "cnpg-cluster.backupSecretName" $ }}
-          key: "region"
-        {{- end }}
-        {{- with .Values.backup.s3Credentials.sessionToken }}
-        sessionToken:
-          name: {{ include "cnpg-cluster.backupSecretName" $ }}
-          key: "sessionToken"
-        {{- end }}
-        {{- with .Values.backup.s3Credentials.inheritFromIAMRole }}
-        inheritFromIAMRole: {{ . }}
-        {{- end }}
-    {{- else if .Values.backup.googleCredentials }}
-      googleCredentials:
-        {{- with .Values.backup.googleCredentials.gkeEnvironment }}
-        gkeEnvironment: {{ . }}
-        {{- end }}
-        {{- with .Values.backup.googleCredentials.applicationCredentials }}
-        applicationCredentials:
-          name: {{ include "cnpg-cluster.backupSecretName" $ }}
-          key: "applicationCredentials"
-        {{- end }}
-    {{- else if .Values.backup.azureCredentials  }}
-      azureCredentials:
-        {{- with .Values.backup.azureCredentials.connectionString }}
-        connectionString:
-          name: {{ .name }}
-          key: {{ .key }}
-        {{- end }}
-        {{- with .Values.backup.azureCredentials.storageAccount }}
-        storageAccount:
-          name: {{ .name }}
-          key: {{ .key }}
-        {{- end }}
-        {{- with .Values.backup.azureCredentials.storageKey }}
-        storageKey:
-          name: {{ .name }}
-          key: {{ .key }}
-        {{- end }}
-        {{- with .Values.backup.azureCredentials.storageSasToken }}
-        storageSasToken:
-          name: {{ .name }}
-          key: {{ .key }}
-        {{- end }}
-        {{- with .Values.backup.azureCredentials.inheritFromAzureAD }}
-        inheritFromAzureAD: {{ . }}
-        {{- end }}
-    {{- else }}
-    {{- end }}
-{{- end }}
-  
-  minSyncReplicas: {{ .Values.minSyncReplicas }}
-  maxSyncReplicas: {{ .Values.maxSyncReplicas }}
-  postgresql:
-    parameters:
-      {{- with .Values.postgresqlParameters }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-
-  monitoring:
-    enablePodMonitor: {{ .Values.monitoring.enablePodMonitor }}
-
-  {{ if .Values.superuserSecretName }}
-  superuserSecret:
-    name: {{ .Values.superuserSecretName }}
-  {{ end}}
-
-  bootstrap:
-    {{- if .Values.recovery.enabled }}
-    recovery:
-      source: "{{ or .Values.recovery.externalClusterName "cnpg-cluster" }}"
-      {{- if .Values.recovery.targetTime }}
-      recoveryTarget:
-        targetTime: "{{ .Values.recovery.targetTime }}"
-      {{/* {{- else }} */}}
-      {{/* recoveryTarget: */}}
-      {{/*   targetTLI: "latest" */}}
-      {{- end }}
-    {{- else }}
-    initdb:
-      database: {{ .Values.dbName }}
-      owner: {{ .Values.dbOwner }}
-      {{ if .Values.dbSecretName }}
-      secret:
-        name: {{ .Values.dbSecretName }}
-      {{ end }}
-      # postgis configuration plugins
-      postInitTemplateSQL:
-        {{- range $name := .Values.extensions }}
-          - CREATE EXTENSION IF NOT EXISTS "{{ $name }}";
-        {{- end }}
-      {{ if .Values.postInitApplicationSQL }}
-      postInitApplicationSQL:
-        {{- toYaml .Values.postInitApplicationSQL | nindent 8 }}
-      {{ end }}
-    {{- end }}
-
-  {{- if .Values.recovery.enabled }}
-  externalClusters:
-    - name: "{{ or .Values.recovery.externalClusterName "cnpg-cluster" }}"
-      barmanObjectStore:
-        {{- toYaml .Values.recovery.backup | nindent 8 }}
-  {{- end }}
-
-{{- with .Values.clusterExtraSpec }}
-  {{- toYaml . | nindent 2 }}
-{{- end }}
diff --git a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/pooler.cnpg.yaml b/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/pooler.cnpg.yaml
deleted file mode 100644
index ac0e5b6a3e..0000000000
--- a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/pooler.cnpg.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-{{- range $name, $spec := .Values.poolers }}
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: {{ include "cnpg-cluster.fullname" $ }}-{{ $name }}
-  labels:
-    {{- include "cnpg-cluster.labels" $ | nindent 4 }}
-spec:
-  cluster:
-    name: {{ include "cnpg-cluster.fullname" $ }}
-  {{- toYaml $spec | nindent 2 }}
----
-{{- if $.Values.monitoring.enablePodMonitor }}
-apiVersion: monitoring.coreos.com/v1
-kind: PodMonitor
-metadata:
-  name: {{ include "cnpg-cluster.fullname" $ }}-{{ $name }}
-spec:
-  selector:
-    matchLabels:
-      cnpg.io/poolerName: {{ include "cnpg-cluster.fullname" $ }}-{{ $name }}
-  podMetricsEndpoints:
-  - port: metrics
----
-{{- end }}
-
-{{- end }}
diff --git a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/registry-credentials.secret.yaml b/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/registry-credentials.secret.yaml
deleted file mode 100644
index 57a9b20b99..0000000000
--- a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/registry-credentials.secret.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-{{- range $name, $settings := .Values.registryCredentials }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "cnpg-cluster.fullname" $ }}-{{ $name }}
-  labels:
-    {{- include "cnpg-cluster.labels" $ | nindent 4 }}
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: "{{- printf "{\"auths\":{\"%s\":{\"username\":\"%s\",\"password\":\"%s\",\"email\":\"%s\",\"auth\":\"%s\"}}}" $settings.registry $settings.username $settings.password $settings.email (printf "%s:%s" $settings.username $settings.password | b64enc) | b64enc }}"
----
-{{- end }}
diff --git a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/scheduledbackup.cnpg.yaml b/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/scheduledbackup.cnpg.yaml
deleted file mode 100644
index 40e0201463..0000000000
--- a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/templates/scheduledbackup.cnpg.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-{{- if .Values.backup.enabled }}
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: {{ include "cnpg-cluster.fullname" $ }}-scheduledbackup
-  labels:
-    {{- include "cnpg-cluster.labels" $ | nindent 4 }}
-spec:
-  backupOwnerReference: self
-  cluster:
-    name: {{ include "cnpg-cluster.fullname" $ }}
-  schedule: "{{ .Values.backup.schedule }}"
-{{- end }}
diff --git a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/values.yaml b/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/values.yaml
deleted file mode 100644
index 2660b51f41..0000000000
--- a/packages/kontinuous/tests/samples/extends-ovh/charts-overrides/cnpg-cluster/values.yaml
+++ /dev/null
@@ -1,180 +0,0 @@
-# Default values for cnpg-cluster.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
-
-# -- Number of Postgres instances in the cluster
-replicaCount: 1
-
-image:
-  # -- Postgres image repository. Keep empty to use operator's default image. See: https://cloudnative-pg.io/documentation/1.17/operator_capability_levels/#override-of-operand-images-through-the-crd
-  # repository: "ghcr.io/cloudnative-pg/postgresql"
-  repository: "ghcr.io/cloudnative-pg/postgis"
-  # -- Postgres image pull policy
-  pullPolicy: IfNotPresent
-  # -- Override the Postgres image tag
-  tag: ""
-
-# -- Docker-registry secret names as an array
-imagePullSecrets: []
-# -- Create a docker-registry secret and use it as imagePullSecrets
-registryCredentials:
-# Eg:
-#   mygitlab:
-#     registry: gitlab-registry.example.org
-#     email: foo@example.org
-#     username: foobar
-#     password: secret
-# -- String to partially override cnpg-cluster.fullname template with a string (will prepend the release name)
-nameOverride: ""
-# --  String to fully override cnpg-cluster.fullname template with a string
-fullnameOverride: ""
-
-# -- CPU/Memory resource requests/limits
-resources:
-  {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
-
-# -- Postgres instances labels for pod assignment
-nodeSelector: {}
-
-# -- Postgres instances labels for tolerations pod assignment
-tolerations: []
-
-# -- Extra configuration for Cluster's affinity resource,
-# see: https://cloudnative-pg.io/documentation/1.17/api_reference/#AffinityConfiguration
-extraAffinity: {}
-
-persistence:
-  # -- Size of each instance storage volume
-  size: 8Gi
-  # -- Resize existent PVCs, defaults to true
-  resizeInUseVolumes:
-  # persistence.storageClass -- StorageClass to use for database data,
-  # Applied after evaluating the PVC template, if available.
-  # If not specified, generated PVCs will be satisfied by the default storage class
-  storageClass: ""
-  # persistence.pvcTemplate -- Template to be used to generate the Persistent Volume Claim
-  pvcTemplate: {}
-
-backup:
-  # -- Enable backups
-  enabled: false
-
-  # -- The path where to store the backup (i.e. s3://bucket/path/to/folder) this path,
-  # with different destination folders, will be used for WALs and for data --
-  destinationPath: ""
-
-  # -- RetentionPolicy is the retention policy to be used for backups and WALs (i.e. '60d').
-  # The retention policy is expressed in the form of XXu where XX is a positive integer and
-  # u is in [dwm] - days, weeks, months.
-  retentionPolicy: 30d
-
-  # -- (string) Endpoint to be used to upload data to the cloud, overriding the automatic endpoint discovery
-  endpointURL:
-
-  # -- (string) EndpointCA store the CA bundle of the barman endpoint. Useful when using self-signed
-  # certificates to avoid errors with certificate issuer and barman-cloud-wal-archive
-  endpointCA:
-
-  # -- (string) The server name on S3, the cluster name is used if this parameter is omitted
-  serverName:
-
-  # -- Configuration of the backup of the WAL stream
-  # See: https://cloudnative-pg.io/documentation/1.17/api_reference/#walbackupconfiguration
-  wal: {}
-
-  # -- Configuration of the backup of the data directory
-  # See: https://cloudnative-pg.io/documentation/1.17/api_reference/#DataBackupConfiguration
-  data: {}
-
-  # -- Tags is a list of key value pairs that will be passed to the Barman --tags option
-  tags: {}
-
-  # -- HistoryTags is a list of key value pairs that will be passed to the Barman --history-tags option
-  historyTags: {}
-
-  # -- Override secret name for the backup credentials
-  secretName:
-
-  # -- Enable the secret creation for the backup credentials
-  createSecret: false
-
-  # -- (object) The credentials to use to upload data to Google Cloud Storage
-  # See: https://cloudnative-pg.io/documentation/1.17/api_reference/#GoogleCredentials
-  googleCredentials:
-    #gkeEnvironment:
-    #applicationCredentials:
-
-  # -- (object) The credentials to use to upload data to S3
-  # See: https://cloudnative-pg.io/documentation/1.17/api_reference/#S3Credentials
-  s3Credentials:
-    # accessKeyId:
-    # secretAccessKey:
-    # region:
-    # sessionToken:
-    # inheritFromIAMRole:
-
-  # -- (object) The credentials to use to upload data to Azure Blob Storage
-  # See: https://cloudnative-pg.io/documentation/1.17/api_reference/#AzureCredentials
-  azureCredentials:
-    # connectionString:
-    # storageAccount:
-    # storageKey:
-    # storageSasToken:
-    # inheritFromAzureAD:
-
-# -- Extra configuration for Cluster resource.
-# See: https://cloudnative-pg.io/documentation/1.17/api_reference/#clusterspec
-clusterExtraSpec: {}
-
-# -- ScheduledBackup resources to create for this Cluster resource
-# See: https://cloudnative-pg.io/documentation/1.17/api_reference/#ScheduledBackupSpec
-scheduledBackups: {}
-# Eg:
-#   daily:
-#     schedule: "0 0 0 * * *"
-
-# -- Poller resources to create for this Cluster resource
-# See: https://cloudnative-pg.io/documentation/1.17/api_reference/#PoolerSpec
-poolers: {}
-# Eg:
-#   rw:
-#     instances: 3
-#     type: rw
-#     pgbouncer:
-#       poolMode: session
-#       parameters:
-#         max_client_conn: "1000"
-#         default_pool_size: "10"
-
-minSyncReplicas: 0
-maxSyncReplicas: 0
-
-postgresqlParameters: {}
-
-extensions: []
-
-dbName: app
-dbOwner: app
-
-monitoring:
-  enablePodMonitor: false
-
-superuserSecretName:
-
-recovery:
-  enabled: false
-  # the name of the source cluster in the backups
-  # externalClusterName: source-cluster-name
-
-# List of SQL queries to be executed as a superuser in the application database right after is created - to be used with extreme care (by default empty)
-postInitApplicationSQL: ""
diff --git a/packages/kontinuous/tests/samples/extends-ovh/config.yaml b/packages/kontinuous/tests/samples/extends-ovh/config.yaml
index 2e1ec273b9..2ed4066631 100644
--- a/packages/kontinuous/tests/samples/extends-ovh/config.yaml
+++ b/packages/kontinuous/tests/samples/extends-ovh/config.yaml
@@ -1,3 +1,5 @@
+projectName: fabrique
+
 dependencies:
   fabrique:
     import: socialgouv/kontinuous/plugins/fabrique
@@ -5,5 +7,7 @@ dependencies:
       - name: ovh
         ifEnv: [dev]
 
-links:
-  socialgouv/helm-charts/charts/cnpg-cluster@v1: ./charts-overrides/cnpg-cluster
\ No newline at end of file
+# links:
+  # socialgouv/helm-charts/charts/cnpg-cluster@v1: ./charts-overrides/cnpg-cluster
+remoteLinks:
+  socialgouv/helm-charts/charts/cnpg-cluster@v1: socialgouv/helm-charts/charts/cnpg-cluster@v1.9.1
\ No newline at end of file
diff --git a/packages/kontinuous/tests/samples/override-env-default/config.yaml b/packages/kontinuous/tests/samples/override-env-default/config.yaml
new file mode 100644
index 0000000000..d9c93ac244
--- /dev/null
+++ b/packages/kontinuous/tests/samples/override-env-default/config.yaml
@@ -0,0 +1,11 @@
+projectName: fabrique
+
+dependencies:
+  fabrique:
+    import: socialgouv/kontinuous/plugins/fabrique
+    extends:
+      - name: ovh
+        ifEnv: [dev]
+
+remoteLinks:
+  socialgouv/helm-charts/charts/cnpg-cluster@v1: socialgouv/helm-charts/charts/cnpg-cluster@v1.9.1
\ No newline at end of file
diff --git a/packages/kontinuous/tests/samples/override-env-default/env/dev/values.yaml b/packages/kontinuous/tests/samples/override-env-default/env/dev/values.yaml
new file mode 100644
index 0000000000..1f9f0dfa71
--- /dev/null
+++ b/packages/kontinuous/tests/samples/override-env-default/env/dev/values.yaml
@@ -0,0 +1,4 @@
+pg:
+  ~chart: pg
+  backup:
+    enabled: true
\ No newline at end of file
diff --git a/plugins/contrib/values-compilers/10-tpl-meta-values.js b/plugins/contrib/values-compilers/10-tpl-meta-values.js
index 1b7ee0090c..dda91b36e8 100644
--- a/plugins/contrib/values-compilers/10-tpl-meta-values.js
+++ b/plugins/contrib/values-compilers/10-tpl-meta-values.js
@@ -2,15 +2,22 @@ const renderTplRecurse = async (
   values,
   context,
   recursiveContext = [],
+  chartValues = values,
+  parentValues = values,
   rootValues = values
 ) => {
   if (typeof values !== "object" || values === null) {
     return
   }
-  const { config, utils } = context
+  const { config, utils, logger } = context
   const { renderTpl, yaml } = utils
   const { buildPath } = config
 
+  if (values._isChartValues) {
+    chartValues = values
+    parentValues = { ...values, Parent: parentValues }
+  }
+
   for (const key of Object.keys(values)) {
     const isTplCast = key.startsWith("~tpl:")
     if (key.startsWith("~tpl~") || isTplCast) {
@@ -19,21 +26,25 @@ const renderTplRecurse = async (
       const prefix = isTplCast ? `~${key.split("~").slice(1, 2)}~` : "~tpl~"
       const newKey = key.slice(prefix.length)
 
-      const extraValues = {
-        kontinuous: {
-          chart: recursiveContext.join("."),
-          parentChart: recursiveContext.slice(0, -1).join("."),
-          chartContext: recursiveContext,
-        },
+      let value
+      try {
+        value = await renderTpl(tpl, {
+          dir: `${buildPath}/tpl`,
+          values: {
+            ...chartValues,
+            global: rootValues.global || {},
+            kontinuous: {
+              chart: recursiveContext.join("."),
+              parentChart: recursiveContext.slice(0, -1).join("."),
+              chartContext: recursiveContext,
+            },
+            Parent: parentValues.Parent,
+          },
+        })
+      } catch (error) {
+        logger.warn(`failed to render tpl key "${key}", value is "${tpl}"`)
+        throw error
       }
-
-      let value = await renderTpl(tpl, {
-        dir: `${buildPath}/tpl`,
-        values: {
-          ...rootValues,
-          ...extraValues,
-        },
-      })
       value = yaml.loadValue(value)
       if (isTplCast) {
         const cast = prefix.slice(1, -1).split(":").slice(1)
@@ -64,6 +75,8 @@ const renderTplRecurse = async (
         values[key],
         context,
         [...recursiveContext, key],
+        chartValues,
+        parentValues,
         rootValues
       )
     }
diff --git a/plugins/fabrique/charts/pg/values.yaml b/plugins/fabrique/charts/pg/values.yaml
index 2585b9a17b..f94eb4a941 100644
--- a/plugins/fabrique/charts/pg/values.yaml
+++ b/plugins/fabrique/charts/pg/values.yaml
@@ -1,3 +1,6 @@
+backup:
+  enabled: false
+
 cnpg-cluster:
   enabled: true
   fullnameOverride: test-cluster
@@ -8,7 +11,7 @@ cnpg-cluster:
     - {{ .Values.kontinuous.parentChart }}.jobs-pg
   ~tpl~dbOwner: "{{ .Values.global.pgUser }}"
   ~tpl~dbName: "{{ .Values.global.pgDatabase }}"
-  ~tpl~instances: "{{ if (or .Values.global.isProd .Values.global.isPreprod) }}3{{else}}1{{end}}"
+  ~tpl~instances: "{{ (or .Values.global.isProd .Values.global.isPreProd) | ternary `3` `1` }}"
   postgresqlParameter:
     timezone: "Europe/Paris"
   extensions:
@@ -21,7 +24,7 @@ cnpg-cluster:
     - pgcrypto
     - hstore
   monitoring:
-    ~tpl~enablePodMonitor: "{{ if (or .Values.global.isProd .Values.global.isPreprod) }}true{{else}}false{{end}}"
+    ~tpl~enablePodMonitor: "{{ (or .Values.global.isProd .Values.global.isPreProd) | ternary `true` `false` }}"
   persistence:
     size: 8Gi
     # pvcTemplate:
@@ -30,13 +33,30 @@ cnpg-cluster:
     tag: "14"
   poolers:
     rw:
-      ~tpl~instances: "{{ if (or .Values.global.isProd .Values.global.isPreprod) }}3{{else}}1{{end}}"
+      ~tpl~instances: "{{ (or .Values.global.isProd .Values.global.isPreProd) | ternary `3` `1` }}"
       type: rw
       pgbouncer:
         poolMode: session
         parameters:
           max_client_conn: "1000"
           # default_pool_size: "10"
+  backup:
+    ~tpl~enabled: "{{ (or .Values.Parent.backup.enabled .Values.global.isProd .Values.global.isPreProd) | ternary `true` `false` }}"
+    schedule: "0 0 0 * * *" # daily
+    retentionPolicy: 60d
+    barmanObjectStore:
+      ~tpl~destinationPath: "s3://{{ .Values.global.projectName }}-{{ .Values.global.isProd | ternary `prod` `dev` }}/{{ .Values.global.namespace }}"
+      ~tpl~endpointURL: "{{ .Values.global.pgBackupEndpointURL }}"
+      s3Credentials:
+        accessKeyId:
+          ~tpl~name: "{{ .Values.global.projectName }}-{{ .Values.global.isProd | ternary `prod` `dev` }}-backups-access-key"
+          key: bucket_access_key
+        secretAccessKey:
+          ~tpl~name: "{{ .Values.global.projectName }}-{{ .Values.global.isProd | ternary `prod` `dev` }}-backups-access-key"
+          key: bucket_secret_key
+        region:
+          ~tpl~name: "{{ .Values.global.projectName }}-{{ .Values.global.isProd | ternary `prod` `dev` }}-backups-access-key"
+          key: bucket_region
 
 jobs-pg:
   enabled: true
diff --git a/plugins/fabrique/kontinuous.yaml b/plugins/fabrique/kontinuous.yaml
index 7aa6298427..6d79bbfe66 100644
--- a/plugins/fabrique/kontinuous.yaml
+++ b/plugins/fabrique/kontinuous.yaml
@@ -15,6 +15,8 @@ dependencies:
         enabled: true
         options:
           enableDefaultCharts: true
+          mergeValues:
+            pgBackupEndpointURL: https://s3.gra.io.cloud.ovh.net
 
     patches:
       certs: