diff --git a/sysadmin/grid5000/cassandra/kubernetes/10-objstorage.yml b/sysadmin/grid5000/cassandra/kubernetes/10-objstorage.yml
index 48c0bda..d527e13 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/10-objstorage.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/10-objstorage.yml
@@ -1,187 +1,194 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: objstorage
 data:
   config.yml: |
     objstorage:
       cls: pathslicing
       args:
         root: "/srv/softwareheritage/objects"
         slicing: 0:2/2:4/4:6
     client_max_size: 1073741824
   entrypoint.sh: |
     #!/bin/bash
 
     set -e
 
     # source /srv/softwareheritage/utils/pyutils.sh
     # setup_pip
 
     # echo Installed Python packages:
     # pip list
 
     echo Starting the swh-objstorage API server
     exec gunicorn --bind 0.0.0.0:5003 \
       --worker-class aiohttp.worker.GunicornWebWorker \
       --log-level DEBUG \
       --workers 200 \
       --reload \
       --timeout 3600 \
       --config 'python:swh.core.api.gunicorn_config' \
       'swh.objstorage.api.server:make_app_from_configfile()'
 ---
 apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: objstorage-pv
 spec:
   capacity:
     storage: 10Gi
   volumeMode: Filesystem
   accessModes:
   - ReadWriteOnce
   persistentVolumeReclaimPolicy: Delete
   storageClassName: objstorage-pv
   local:
     path: /srv/data/softwareheritage-kube/objects
   nodeAffinity:
     required:
       nodeSelectorTerms:
       - matchExpressions:
         # - key: kubernetes.io/hostname
         #   operator: In
         #   values:
         #   - parasilo-19.rennes.grid5000.fr
-        - key: type
+        - key: worker
           operator: In
           values:
-          - loader   
+          - 'true'
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: objstorage-pvc
 spec:
   accessModes:
   - ReadWriteOnce
   storageClassName: objstorage-pv
   resources:
     requests:
       storage: 10Gi
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: objstorage
   labels:
     app: objstorage
 spec:
   replicas: 4
   selector:
     matchLabels:
       app: objstorage
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
         app: objstorage
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              # - key: kubernetes.io/hostname
-              #   operator: In
-              #   values:
-              #   - parasilo-19.rennes.grid5000.fr
-              - key: type
+              - key: worker
                 operator: In
                 values:
-                - loader   
+                - 'true'
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1 
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app
+                  operator: In
+                  values:
+                  - objstorage
+              topologyKey: kubernetes.io/hostname
       containers:
       - name: objstorage
         image: vsellier/swh-base
         imagePullPolicy: Always
         command:
           - /entrypoint.sh
         ports:
         - containerPort: 5003
         readinessProbe:
           httpGet:
             path: /
             port: 5003
             scheme: "HTTP"
           initialDelaySeconds: 0
           failureThreshold: 2
           periodSeconds: 10
         startupProbe:
           httpGet:
             path: /
             port: 5003
             scheme: "HTTP"
           initialDelaySeconds: 5
           failureThreshold: 30
           periodSeconds: 1
         env:
         - name: PORT
           value: "5003"
         - name: STATSD_HOST
           value: "prometheus-statsd-exporter"
         - name: STATSD_PORT
           value: "9125"
         - name: SWH_CONFIG_FILENAME
           value: /etc/softwareheritage/config.yml
         volumeMounts:
         - mountPath: "/srv/softwareheritage/objects"
           name: objstorage-pvc
         - name: config
           mountPath: /etc/softwareheritage/config.yml
           subPath: config.yml
           readOnly: true
         - name: config
           mountPath: /entrypoint.sh
           subPath: entrypoint.sh
           readOnly: true
       volumes:
         - name: config
           configMap:
             name: objstorage
             defaultMode: 0777
         - name: objstorage-pvc
           persistentVolumeClaim:
             claimName: objstorage-pvc
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: objstorage
 spec:
   type: ClusterIP
   selector:
     app: objstorage
   ports:
     - port: 5003
       targetPort: 5003
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: objstorage
 spec:
   rules:
   - host: objstorage.default
     http:
       paths:
       - path: /
         pathType: Prefix
         backend:
           service:
             name: objstorage
             port:
               number: 5003
diff --git a/sysadmin/grid5000/cassandra/kubernetes/11-storage.yml b/sysadmin/grid5000/cassandra/kubernetes/11-storage.yml
index 47a5f4d..3eb7bc3 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/11-storage.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/11-storage.yml
@@ -1,154 +1,170 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: storage
 data:
   config.yml: |
     storage:
       cls: cassandra
       hosts: 
         - parasilo-2.rennes.grid5000.fr
         - parasilo-3.rennes.grid5000.fr
         - parasilo-4.rennes.grid5000.fr
         - parasilo-5.rennes.grid5000.fr
         - parasilo-6.rennes.grid5000.fr
         - parasilo-7.rennes.grid5000.fr
         - parasilo-8.rennes.grid5000.fr
       keyspace: swh
       consistency_level: LOCAL_QUORUM
+      #select_missing_algo: concurrent
+      #select_missing_algo: grouped-naive
+      #select_missing_algo: grouped-pk-serial
+      select_missing_algo: grouped-pk-concurrent
+      directory_entries_insert_algo: batch
       objstorage:
         cls: remote
         url: http://objstorage:5003 
 
   entrypoint.sh: |
     #!/bin/bash
 
     set -e
 
     echo Starting the swh-storage API server
     exec gunicorn --bind 0.0.0.0:5002 \
           --reload \
           --access-logfile /dev/stdout \
           --access-logformat "%(t)s %(s)s %(r)s %(M)s" \
           --workers 128 \
           --log-level INFO \
           --timeout 3600 \
           --config 'python:swh.core.api.gunicorn_config' \
           'swh.storage.api.server:make_app_from_configfile()'
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: storage
   labels:
     app: storage
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: storage
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
         app: storage
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: type
+              - key: worker
                 operator: In
                 values:
-                - loader   
+                - 'true'
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1 
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app
+                  operator: In
+                  values:
+                  - objstorage
+              topologyKey: kubernetes.io/hostname
       containers:
       - name: storage
-        image: vsellier/swh-base
+        image: vsellier/swh-base:D6495
         imagePullPolicy: Always
         command:
           - /entrypoint.sh
         ports:
         - containerPort: 5002
         readinessProbe:
           httpGet:
             path: /
             port: 5002
             scheme: "HTTP"
           initialDelaySeconds: 0
           failureThreshold: 2
           periodSeconds: 10
         startupProbe:
           httpGet:
             path: /
             port: 5002
             scheme: "HTTP"
           initialDelaySeconds: 5
           failureThreshold: 30
           periodSeconds: 1
         env:
         - name: PORT
           value: "5002"
         - name: STATSD_HOST
           value: "prometheus-statsd-exporter"
         - name: STATSD_PORT
           value: "9125"
         - name: SWH_CONFIG_FILENAME
           value: /etc/softwareheritage/config.yml
         volumeMounts:
           - name: config
             mountPath: /etc/softwareheritage/config.yml
             subPath: config.yml
             readOnly: true
           - name: config
             mountPath: /entrypoint.sh
             subPath: entrypoint.sh
             readOnly: true
         # resources:
         #   requests:
         #     memory: "10000Mi"
         #     cpu: "5000m"
         #   limits:
         #     memory: "15000Mi"
         #     cpu: "10000m"
       volumes:
         - name: config
           configMap:
             name: storage
             defaultMode: 0777
         - name: db-password
           secret:
             secretName: storage-db
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: storage
 spec:
   type: ClusterIP
   selector:
     app: storage
   ports:
     - port: 5002
       targetPort: 5002
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: storage
 spec:
   rules:
   - host: storage.default
     http:
       paths:
       - path: /
         pathType: Prefix
         backend:
           service:
             name: storage
             port:
               number: 5002
diff --git a/sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml b/sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml
index 5c4f570..caf8bd9 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml
@@ -1,138 +1,138 @@
 ---
 apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: scheduler-db-pv
 spec:
   capacity:
     storage: 10Gi
   volumeMode: Filesystem
   accessModes:
   - ReadWriteOnce
   persistentVolumeReclaimPolicy: Delete
   storageClassName: scheduler-db
   local:
     path: /srv/data/softwareheritage-kube/scheduler-db
   nodeAffinity:
     required:
       nodeSelectorTerms:
       - matchExpressions:
         # TODO adapt for your needs
-        - key: kubernetes.io/hostname
+        - key: storage
           operator: In
           values:
-          - parasilo-19.rennes.grid5000.fr
+          - 'true'
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: scheduler-db-pvc
 spec:
   accessModes:
   - ReadWriteOnce
   storageClassName: scheduler-db
   resources:
     requests:
       storage: 10Gi
 
 ---
 ## TODO Change this to your real postgresql password
 apiVersion: v1
 kind: Secret
 metadata:
   name: scheduler-db
 type: Opaque
 stringData:
   POSTGRES_PASSWORD: swh
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: scheduler-db
 data:
   # property-like keys; each key maps to a simple value
   POSTGRES_USER: swh
   POSTGRES_DB: swh-scheduler
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: scheduler-db
   labels:
     app: scheduler-db
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: scheduler-db
   template:
     metadata:
       labels:
         app: scheduler-db
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: kubernetes.io/hostname
+              - key: storage
                 operator: In
                 values:
-                - parasilo-19.rennes.grid5000.fr
+                - 'true'
       containers:
       - name: scheduler-db
         image: postgres:13.0
         imagePullPolicy: Always
         ports:
         - containerPort: 5432
         args:
           - "-c"
           - "shared_buffers=5GB"
           - "-c"
           - "effective_cache_size=512MB"
           - "-c"
           - "random_page_cost=1.5"
           - "-c"
           - "max_wal_size=1GB"
         env:
           - name: POSTGRES_USER
             valueFrom:
               configMapKeyRef:
                 name: scheduler-db
                 key: POSTGRES_USER
           - name: POSTGRES_PASSWORD
             valueFrom:
               secretKeyRef:
                 name: scheduler-db
                 key: POSTGRES_PASSWORD
           - name: POSTGRES_DB
             valueFrom:
               configMapKeyRef:
                 name: scheduler-db
                 key: POSTGRES_DB
         volumeMounts:
         - mountPath: "/var/lib/postgresql/data"
           name: scheduler-db-pvc
         resources:
           requests:
             memory: "5Gi"
             cpu: "2000m"
           limits:
             memory: "10Gi"
             cpu: "5000m"
       volumes:
         - name: scheduler-db-pvc
           persistentVolumeClaim:
             claimName: scheduler-db-pvc
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: scheduler-db
 spec:
   type: ClusterIP
   selector:
     app: scheduler-db
   ports:
     - port: 5432
       targetPort: 5432
diff --git a/sysadmin/grid5000/cassandra/kubernetes/16-rabbitmq.yml b/sysadmin/grid5000/cassandra/kubernetes/16-rabbitmq.yml
index ec3ff1c..d2b04ba 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/16-rabbitmq.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/16-rabbitmq.yml
@@ -1,65 +1,65 @@
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: amqp
   labels:
     app: amqp
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: amqp
   template:
     metadata:
       labels:
         app: amqp
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: kubernetes.io/hostname
+              - key: admin
                 operator: In
                 values:
-                - parasilo-19.rennes.grid5000.fr
+                - 'true'
       containers:
       - name: amqp
         image: rabbitmq:3.7-management
         imagePullPolicy: Always
         ports:
         - containerPort: 5672
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: amqp
 spec:
   type: ClusterIP
   selector:
     app: amqp
   ports:
     - port: 5672
       targetPort: 5672
       name: rabbitmq
     - port: 15672
       targetPort: 15672
       name: rabbitmq-admin
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: amqp
 spec:
   rules:
   - host: rabbitmq.default
     http:
       paths:
       - path: /
         pathType: Prefix
         backend:
           service:
             name: amqp
             port:
               number: 15672
diff --git a/sysadmin/grid5000/cassandra/kubernetes/20-scheduler.yml b/sysadmin/grid5000/cassandra/kubernetes/20-scheduler.yml
index 82f4159..148dbf3 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/20-scheduler.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/20-scheduler.yml
@@ -1,212 +1,211 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: scheduler
 data:
   config.yml: |
     scheduler:
       cls: local
       db: postgresql:///?service=swh-scheduler
 
     celery:
       task_broker: amqp://guest:guest@amqp/%2f
       broker_transport_options:
         max_retries: 1
   entrypoint-init-db.sh: |
     #!/bin/bash
 
     set -e
 
     echo -n "waiting for database availability"
     set +e
     ko=1
     while [[ $ko -gt 0 ]]; do PGCONNECT_TIMEOUT=2 psql --list &>/dev/null;ko=$?; echo -n .; sleep 0.5; done
     echo
     set -e
 
     echo Init swh-scheduler database
 
     echo Creating extensions...
     swh db init-admin --db-name ${PGDATABASE} scheduler
 
     echo Initializing the database...
     swh db init --db-name ${PGDATABASE} scheduler
   entrypoint.sh: |
     #!/bin/bash
 
     set -e
 
     echo "${PGHOST}:5432:${PGDATABASE}:${PGUSER}:${PGPASSWORD}" >> ~/.pgpass
     cat >> ~/.pg_service.conf <<EOF
     [${PGDATABASE}]
     dbname=${PGDATABASE}
     host=${PGHOST}
     port=5432
     user=${PGUSER}
     EOF
 
     echo Starting the swh-scheduler API server
     exec gunicorn --bind 0.0.0.0:5008 \
          --log-level ${LOGLEVEL} \
-         --threads 4 \
-         --workers 2 \
+         --workers 8 \
          --reload \
          --timeout 3600 \
          --config 'python:swh.core.api.gunicorn_config' \
          'swh.scheduler.api.server:make_app_from_configfile()'
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: scheduler
   labels:
     app: scheduler
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: scheduler
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
         app: scheduler
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: kubernetes.io/hostname
+              - key: admin
                 operator: In
                 values:
-                - parasilo-19.rennes.grid5000.fr
+                - 'true'
       initContainers:
         - name: scheduler-init
           image: vsellier/swh-base
           imagePullPolicy: Always
           command:
             - /entrypoint.sh
           env:
           - name: PGHOST
             value: "scheduler-db"
           - name: PGUSER
             valueFrom:
               configMapKeyRef:
                 name: scheduler-db
                 key: POSTGRES_USER
           - name: PGPASSWORD
             valueFrom:
               secretKeyRef:
                 name: scheduler-db
                 key: POSTGRES_PASSWORD
           - name: PGDATABASE
             valueFrom:
               configMapKeyRef:
                 name: scheduler-db
                 key: POSTGRES_DB
           - name: SWH_CONFIG_FILENAME
             value: /etc/softwareheritage/config.yml
           volumeMounts:
             - name: db-password
               mountPath: /run/secrets/postgres-password
               subPath: POSTGRES_PASSWORD
               readOnly: true
             - name: config
               mountPath: /etc/softwareheritage/config.yml
               subPath: config.yml
               readOnly: true
             - name: config
               mountPath: /entrypoint.sh
               subPath: entrypoint-init-db.sh
               readOnly: true
       containers:
       - name: scheduler
         image: vsellier/swh-base
         imagePullPolicy: Always
         command:
           - /entrypoint.sh
         ports:
         - containerPort: 5008
         env:
         - name: PORT
           value: "5008"
         - name: STATSD_HOST
           value: "prometheus-statsd-exporter"
         - name: STATSD_PORT
           value: "9125"
         - name: PGHOST
           value: "scheduler-db"
         - name: PGUSER
           valueFrom:
             configMapKeyRef:
               name: scheduler-db
               key: POSTGRES_USER
         - name: PGPASSWORD
           valueFrom:
             secretKeyRef:
               name: scheduler-db
               key: POSTGRES_PASSWORD
         - name: PGDATABASE
           valueFrom:
             configMapKeyRef:
               name: scheduler-db
               key: POSTGRES_DB
         - name: SWH_CONFIG_FILENAME
           value: /etc/softwareheritage/config.yml
         - name: LOGLEVEL
           value: INFO
         volumeMounts:
           - name: db-password
             mountPath: /run/secrets/postgres-password
             subPath: POSTGRES_PASSWORD
             readOnly: true
           - name: config
             mountPath: /etc/softwareheritage/config.yml
             subPath: config.yml
             readOnly: true
           - name: config
             mountPath: /entrypoint.sh
             subPath: entrypoint.sh
             readOnly: true
       volumes:
         - name: config
           configMap:
             name: scheduler
             defaultMode: 0777
         - name: db-password
           secret:
             secretName: scheduler-db
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: scheduler
 spec:
   type: ClusterIP
   selector:
     app: scheduler
   ports:
     - port: 5008
       targetPort: 5008
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: scheduler
 spec:
   rules:
   - host: scheduler.default
     http:
       paths:
       - path: /
         pathType: Prefix
         backend:
           service:
             name: scheduler
             port:
               number: 5008
diff --git a/sysadmin/grid5000/cassandra/kubernetes/21-scheduler-runner.yml b/sysadmin/grid5000/cassandra/kubernetes/21-scheduler-runner.yml
index ccf75db..e45fca1 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/21-scheduler-runner.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/21-scheduler-runner.yml
@@ -1,142 +1,142 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: scheduler-runner
 data:
   config.yml: |
     scheduler:
       cls: remote
       url: http://scheduler:5008
     celery:
       task_broker: amqp://guest:guest@amqp/%2f
       broker_transport_options:
         max_retries: 1
 
   entrypoint-init.sh: |
     #!/bin/bash
 
     set -e
 
     echo Waiting on the scheduler service
     wait-for-it scheduler:5008 -s --timeout=0
 
     echo Waiting on the rabbit
     exec wait-for-it amqp:5672 -s --timeout=0
   entrypoint.sh: |
     #!/bin/bash
 
     set -e
 
     echo "Starting the swh-scheduler"
     swh --log-level ${LOGLEVEL} scheduler -C /etc/softwareheritage/config.yml start-runner --period 10
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: scheduler-runner
   labels:
     app: scheduler-runner
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: scheduler-runner
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
         app: scheduler-runner
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: kubernetes.io/hostname
+              - key: admin
                 operator: In
                 values:
-                - parasilo-19.rennes.grid5000.fr
+                - 'true'
       initContainers:
         - name: scheduler-runner-init
           image: vsellier/swh-base
           imagePullPolicy: Always
           command:
           - /entrypoint-init.sh
           volumeMounts:
           - name: config
             mountPath: /entrypoint-init.sh
             subPath: entrypoint-init.sh
             readOnly: true
       containers:
       - name: scheduler-runner
         image: vsellier/swh-base
         imagePullPolicy: Always
         command:
         - /entrypoint.sh
         ports:
         - containerPort: 5008
         resources:
           requests:
             cpu: "50m"
             memory: "100Mi"
           limits:
             cpu: "200m"
             memory: "200Mi"
         env:
         - name: PORT
           value: "5008"
         - name: STATSD_HOST
           value: "prometheus-statsd-exporter"
         - name: STATSD_PORT
           value: "9125"
         - name: SWH_CONFIG_FILENAME
           value: /etc/softwareheritage/config.yml
         - name: LOGLEVEL
           value: INFO
         volumeMounts:
           - name: config
             mountPath: /etc/softwareheritage/config.yml
             subPath: config.yml
             readOnly: true
           - name: config
             mountPath: /entrypoint.sh
             subPath: entrypoint.sh
             readOnly: true
       volumes:
         - name: config
           configMap:
             name: scheduler-runner
             defaultMode: 0777
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: scheduler-runner
 spec:
   type: ClusterIP
   selector:
     app: scheduler-runner
   ports:
     - port: 5008
       targetPort: 5008
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: scheduler-runner
 spec:
   rules:
   - host: scheduler-runner.default
     http:
       paths:
       - path: /
         pathType: Prefix
         backend:
           service:
             name: scheduler-runner
             port:
               number: 5008
diff --git a/sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml b/sysadmin/grid5000/cassandra/kubernetes/29-web-db.yml
similarity index 67%
copy from sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml
copy to sysadmin/grid5000/cassandra/kubernetes/29-web-db.yml
index 5c4f570..082c50f 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/29-web-db.yml
@@ -1,138 +1,138 @@
 ---
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: scheduler-db-pv
+  name: web-db-pv
 spec:
   capacity:
     storage: 10Gi
   volumeMode: Filesystem
   accessModes:
   - ReadWriteOnce
   persistentVolumeReclaimPolicy: Delete
-  storageClassName: scheduler-db
+  storageClassName: web-db
   local:
-    path: /srv/data/softwareheritage-kube/scheduler-db
+    path: /srv/data/softwareheritage-kube/web-db
   nodeAffinity:
     required:
       nodeSelectorTerms:
       - matchExpressions:
-        # TODO adapt for your needs
-        - key: kubernetes.io/hostname
+        - key: storage
           operator: In
           values:
-          - parasilo-19.rennes.grid5000.fr
+          - 'true'
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: scheduler-db-pvc
+  name: web-db-pvc
 spec:
   accessModes:
   - ReadWriteOnce
-  storageClassName: scheduler-db
+  storageClassName: web-db
   resources:
     requests:
       storage: 10Gi
 
 ---
 ## TODO Change this to your real postgresql password
 apiVersion: v1
 kind: Secret
 metadata:
-  name: scheduler-db
+  name: web-db
 type: Opaque
 stringData:
   POSTGRES_PASSWORD: swh
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: scheduler-db
+  name: web-db
 data:
   # property-like keys; each key maps to a simple value
   POSTGRES_USER: swh
-  POSTGRES_DB: swh-scheduler
+  POSTGRES_DB: swh-web
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: scheduler-db
+  name: web-db
   labels:
-    app: scheduler-db
+    app: web-db
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: scheduler-db
+      app: web-db
   template:
     metadata:
       labels:
-        app: scheduler-db
+        app: web-db
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: kubernetes.io/hostname
+              - key: storage
                 operator: In
                 values:
-                - parasilo-19.rennes.grid5000.fr
+                - 'true'
       containers:
-      - name: scheduler-db
+      - name: web-db
         image: postgres:13.0
         imagePullPolicy: Always
         ports:
         - containerPort: 5432
         args:
           - "-c"
           - "shared_buffers=5GB"
           - "-c"
-          - "effective_cache_size=512MB"
+          - "effective_cache_size=2GB"
           - "-c"
           - "random_page_cost=1.5"
           - "-c"
           - "max_wal_size=1GB"
         env:
           - name: POSTGRES_USER
             valueFrom:
               configMapKeyRef:
-                name: scheduler-db
+                name: web-db
                 key: POSTGRES_USER
           - name: POSTGRES_PASSWORD
             valueFrom:
               secretKeyRef:
-                name: scheduler-db
+                name: web-db
                 key: POSTGRES_PASSWORD
           - name: POSTGRES_DB
             valueFrom:
               configMapKeyRef:
-                name: scheduler-db
+                name: web-db
                 key: POSTGRES_DB
         volumeMounts:
         - mountPath: "/var/lib/postgresql/data"
-          name: scheduler-db-pvc
+          name: web-db-pvc
         resources:
           requests:
-            memory: "5Gi"
-            cpu: "2000m"
+            memory: "256Mi"
+            cpu: "500m"
           limits:
-            memory: "10Gi"
-            cpu: "5000m"
+            memory: "1000Mi"
+            cpu: "1000m"
       volumes:
-        - name: scheduler-db-pvc
+        - name: web-db-pvc
           persistentVolumeClaim:
-            claimName: scheduler-db-pvc
+            claimName: web-db-pvc
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: scheduler-db
+  name: web-db
 spec:
-  type: ClusterIP
+  type: NodePort
   selector:
-    app: scheduler-db
+    app: web-db
   ports:
     - port: 5432
       targetPort: 5432
+      nodePort: 32437
diff --git a/sysadmin/grid5000/cassandra/kubernetes/30-webapp.yml b/sysadmin/grid5000/cassandra/kubernetes/30-webapp.yml
new file mode 100644
index 0000000..13b514f
--- /dev/null
+++ b/sysadmin/grid5000/cassandra/kubernetes/30-webapp.yml
@@ -0,0 +1,358 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: webapp
+data:
+  config.yml: |
+    storage:
+      cls: remote
+      args:
+        url: http://storage:5002/
+        timeout: 5
+
+    counters:
+      cls: remote
+      url: http://counters:5011/
+      timeout: 1
+
+    objstorage:
+      cls: remote
+      args:
+        url: http://objstorage:5003/
+
+    indexer_storage:
+      cls: remote
+      args:
+        url: http://idx-storage:5007/
+
+    scheduler:
+      cls: remote
+      args:
+        url: http://scheduler:5008/
+
+    vault:
+      cls: remote
+      args:
+        url: http://vault:5005/
+
+    # deposit:
+    #   private_api_url: https://deposit:5006/1/private/
+    #   private_api_user: swhworker
+    #   private_api_password: ''
+
+    # TODO: remove the *
+    allowed_hosts:
+      - "*"
+      - appserver
+
+    debug: yes
+
+    serve_assets: yes
+
+    history_counters_url: http://counters:5011/counters_history/history.json
+
+    # TODO find a way to make this dynamic
+    production_db:
+      host: web-db
+      port: 5432
+      name: swh-web
+      user: swh
+      password: swh
+
+    throttling:
+      cache_uri: memcached:11211
+      scopes:
+        swh_api:
+          limiter_rate:
+            default: 120/h
+          exempted_networks:
+            - 0.0.0.0/0
+        swh_api_origin_search:
+          limiter_rate:
+            default: 70/m
+          exempted_networks:
+            - 0.0.0.0/0
+        swh_api_origin_visit_latest:
+          limiter_rate:
+            default: 700/m
+          exempted_networks:
+            - 0.0.0.0/0
+        swh_vault_cooking:
+          limiter_rate:
+            default: 120/h
+          exempted_networks:
+            - 0.0.0.0/0
+        swh_save_origin:
+          limiter_rate:
+            default: 120/h
+          exempted_networks:
+            - 0.0.0.0/0
+
+    #search:
+    #  cls: remote
+    #  url: http://search:5010/
+    #metadata_search_backend: swh-search
+    counters_backend: swh-counters
+
+  entrypoint-init.sh: |
+    #!/bin/bash
+
+    set -e
+
+    source /srv/softwareheritage/utils/pgsql.sh
+
+    create_admin_script="
+    from django.contrib.auth import get_user_model
+
+    username = 'admin';
+    password = 'admin';
+    email = 'admin@swh-web.org';
+
+    User = get_user_model();
+
+    if not User.objects.filter(username = username).exists():
+        User.objects.create_superuser(username, email, password);
+    "
+
+    echo "waiting for database availability"
+    wait_pgsql ${PGDATABASE}
+
+    echo "Migrating db using ${DJANGO_SETTINGS_MODULE}"
+    django-admin migrate --settings=${DJANGO_SETTINGS_MODULE}
+
+    echo "Creating Django admin user"
+    echo "$create_admin_script" | python3 -m swh.web.manage shell
+
+  entrypoint.sh: |
+    #!/bin/bash
+
+    set -e
+
+    echo "starting the swh-web server"
+    exec gunicorn --bind 0.0.0.0:5004 \
+         --threads 2 \
+         --workers 2 \
+         --timeout 3600 \
+         --access-logfile '-' \
+         --config 'python:swh.web.gunicorn_config' \
+         'django.core.wsgi:get_wsgi_application()'
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: memcached
+spec:
+  type: ClusterIP
+  selector:
+    app: memcached
+  ports:
+    - port: 11211
+      targetPort: 11211
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: memcached
+  labels:
+    app: memcached
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: memcached
+  template:
+    metadata:
+      labels:
+        app: memcached
+    spec:
+      containers:
+      - name: memcached
+        image: memcached
+        imagePullPolicy: Always
+        resources:
+          limits:
+            memory: "1Gi"
+            cpu: "500m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: webapp
+spec:
+  selector:
+    app: webapp
+  ports:
+    - port: 5004
+      targetPort: 5004
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: webapp
+  labels:
+    name: webapp
+spec:
+  rules:
+    - host: webapp.default
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: webapp
+                port:
+                  number: 5004
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webapp
+spec:
+  selector:
+    matchLabels:
+      app: webapp
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: webapp
+    spec:
+      initContainers:
+        - name: web-init
+          image: vsellier/swh-base:latest
+          imagePullPolicy: Always
+          command:
+            - /entrypoint.sh
+          env:
+          - name: PGHOST
+            value: "web-db"
+          - name: PGUSER
+            valueFrom:
+              configMapKeyRef:
+                name: web-db
+                key: POSTGRES_USER
+          - name: PGPASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: web-db
+                key: POSTGRES_PASSWORD
+          - name: PGDATABASE
+            valueFrom:
+              configMapKeyRef:
+                name: web-db
+                key: POSTGRES_DB
+          - name: DJANGO_SETTINGS_MODULE
+            value: swh.web.settings.production
+          volumeMounts:
+            - name: db-password
+              mountPath: /run/secrets/postgres-password
+              subPath: POSTGRES_PASSWORD
+              readOnly: true
+            - name: config
+              mountPath: /entrypoint.sh
+              subPath: entrypoint-init.sh
+              readOnly: true
+      containers:
+        - name: webapp
+          image: vsellier/swh-base:latest
+          imagePullPolicy: Always
+          command:
+            - /entrypoint.sh
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 5004
+              scheme: "HTTP"
+            initialDelaySeconds: 0
+            failureThreshold: 2
+            periodSeconds: 10
+          startupProbe:
+            httpGet:
+              path: /
+              port: 5004
+              scheme: "HTTP"
+            initialDelaySeconds: 5
+            failureThreshold: 30
+            periodSeconds: 1
+          resources:
+            requests:
+              memory: "196Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "512m"
+          ports:
+            - containerPort: 5004
+          env:
+            - name: PORT
+              value: "5004"
+            - name: VERBOSITY
+              value: "3"
+            - name: DJANGO_SETTINGS_MODULE
+              value: swh.web.settings.production
+            - name: SWH_CONFIG_FILENAME
+              value: /etc/softwareheritage/config.yml
+          volumeMounts:
+            - name: config
+              mountPath: /etc/softwareheritage/config.yml
+              subPath: config.yml
+              readOnly: true
+            - name: config
+              mountPath: /entrypoint.sh
+              subPath: entrypoint.sh
+              readOnly: true
+      volumes:
+        - name: config
+          configMap:
+            name: webapp
+            defaultMode: 0777
+        - name: db-password
+          secret:
+            secretName: web-db
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: save-code-now-refresh-visit-status
+  labels:
+    app: webapp
+spec:
+  schedule: "*/1 * * * *"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+          - name: save-code-now-refresh-visit-status
+            image: vsellier/swh-base:latest
+            imagePullPolicy: Always
+            args:
+            - django-admin
+            - refresh_savecodenow_statuses
+            env:
+            - name: DJANGO_SETTINGS_MODULE
+              value: swh.web.settings.production
+            - name: SWH_CONFIG_FILENAME
+              value: /etc/softwareheritage/config.yml
+            volumeMounts:
+              - name: config
+                mountPath: /etc/softwareheritage/config.yml
+                subPath: config.yml
+                readOnly: true
+          volumes:
+            - name: config
+              configMap:
+                name: webapp
+                defaultMode: 0777
+            - name: db-password
+              secret:
+                secretName: web-db
diff --git a/sysadmin/grid5000/cassandra/kubernetes/40-loaders.yml b/sysadmin/grid5000/cassandra/kubernetes/40-loaders.yml
index 6955582..989f0c8 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/40-loaders.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/40-loaders.yml
@@ -1,162 +1,162 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: loaders
 data:
   config.yml: |
     storage:
       cls: pipeline
       steps:
       - cls: buffer
         min_batch_size:
           content: 500
           content_bytes: 104857600
           directory: 1000
           revision: 50
       - cls: filter
       - cls: retry
       - cls: remote
         url: http://storage:5002/
     max_content_size: 104857600
     temp_file_cutoff: 536870912
     celery:
       task_ignore_result: True
       task_broker: amqp://guest:guest@amqp//
       task_queues:
        - swh.loader.dir.tasks.LoadDirRepository
        - swh.loader.git.tasks.LoadDiskGitRepository
        - swh.loader.git.tasks.UncompressAndLoadDiskGitRepository
        - swh.loader.git.tasks.UpdateGitRepository
        - swh.loader.package.archive.tasks.LoadArchive
        - swh.loader.package.cran.tasks.LoadCRAN
        - swh.loader.package.debian.tasks.LoadDebian
        - swh.loader.package.npm.tasks.LoadNpm
        - swh.loader.package.pypi.tasks.LoadPyPI
 
        - save_code_now:swh.loader.git.tasks.UpdateGitRepository
        # - swh.loader.mercurial.tasks.LoadArchiveMercurial
        # - swh.loader.mercurial.tasks.LoadMercurial
        # - swh.loader.svn.tasks.DumpMountAndLoadSvnRepository
        # - swh.loader.svn.tasks.LoadSvnRepository
        # - swh.loader.svn.tasks.MountAndLoadSvnRepository
   entrypoint-init.sh: |
     #!/bin/bash
 
     set -e
 
     # echo Waiting for RabbitMQ to start
     wait-for-it amqp:5672 -s --timeout=0
 
     # echo Register task types in scheduler database
     wait-for-it scheduler:5008 -s --timeout=0
 
     swh scheduler --url http://scheduler:5008 task-type register
   entrypoint.sh: |
     #!/bin/bash
 
     set -e
 
     echo Starting the swh Celery worker
     exec python -m celery \
                 --app=swh.scheduler.celery_backend.config.app \
                 worker \
                 --pool=prefork \
                 --concurrency=${CONCURRENCY} \
                 --max-tasks-per-child=${MAX_TASKS_PER_CHILD} \
                 -Ofair --loglevel=${LOGLEVEL} \
                 --hostname "${HOSTNAME}"
 
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: loaders
   labels:
     app: loaders
 spec:
-  replicas: 100
+  replicas: 1
   selector:
     matchLabels:
       app: loaders
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
         app: loaders
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: type
+              - key: worker
                 operator: In
                 values:
-                - loader   
+                - 'true'
       initContainers:
         - name: loaders-init
-          image: vsellier/swh-base
+          image: vsellier/swh-base:D6495
           imagePullPolicy: Always
           command:
             - /entrypoint.sh
           volumeMounts:
             - name: config
               mountPath: /etc/softwareheritage/config.yml
               subPath: config.yml
               readOnly: true
             - name: config
               mountPath: /entrypoint.sh
               subPath: entrypoint-init.sh
               readOnly: true
       containers:
       - name: loaders
-        image: vsellier/swh-base
+        image: vsellier/swh-base:D6495
         imagePullPolicy: Always
         command:
           - /entrypoint.sh
         ports:
         - containerPort: 5002
         resources:
           requests:
             memory: "2000Mi"
             cpu: "500m"
           limits:
             memory: "4000Mi"
             cpu: "1000m"
         lifecycle:
           preStop:
            exec:
              command: ["kill", "1"]
         env:
         - name: CONCURRENCY
           value: "1"
         - name: MAX_TASKS_PER_CHILD
           value: "5"
         - name: LOGLEVEL
           value: "INFO"
         - name: SWH_CONFIG_FILENAME
           value: /etc/softwareheritage/config.yml
         - name: TMPDIR
           value: /srv/tmp
         volumeMounts:
           - name: config
             mountPath: /etc/softwareheritage/config.yml
             subPath: config.yml
             readOnly: true
           - name: config
             mountPath: /entrypoint.sh
             subPath: entrypoint.sh
             readOnly: true
           - name: tmp
             mountPath: /srv/tmp
       volumes:
         - name: config
           configMap:
             name: loaders
             defaultMode: 0777
         - name: tmp
           emptyDir: {}                
diff --git a/sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml b/sysadmin/grid5000/cassandra/kubernetes/80-vault-db.yml
similarity index 60%
copy from sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml
copy to sysadmin/grid5000/cassandra/kubernetes/80-vault-db.yml
index 5c4f570..c89fb2d 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/15-scheduler-db.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/80-vault-db.yml
@@ -1,138 +1,131 @@
 ---
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: scheduler-db-pv
+  name: vault-db-pv
 spec:
   capacity:
     storage: 10Gi
   volumeMode: Filesystem
   accessModes:
   - ReadWriteOnce
   persistentVolumeReclaimPolicy: Delete
-  storageClassName: scheduler-db
+  storageClassName: vault-db
   local:
-    path: /srv/data/softwareheritage-kube/scheduler-db
+    path: /srv/data/softwareheritage-kube/vault-db
   nodeAffinity:
     required:
       nodeSelectorTerms:
       - matchExpressions:
         # TODO adapt for your needs
-        - key: kubernetes.io/hostname
+        - key: storage
           operator: In
           values:
-          - parasilo-19.rennes.grid5000.fr
+          - 'true'
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: scheduler-db-pvc
+  name: vault-db-pvc
 spec:
   accessModes:
   - ReadWriteOnce
-  storageClassName: scheduler-db
+  storageClassName: vault-db
   resources:
     requests:
       storage: 10Gi
-
 ---
 ## TODO Change this to your real postgresql password
 apiVersion: v1
 kind: Secret
 metadata:
-  name: scheduler-db
+  name: vault-db
 type: Opaque
+# data:
+#   POSTGRES_PASSWORD: |
+#         "echo 'strong password' | base64"
 stringData:
   POSTGRES_PASSWORD: swh
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: scheduler-db
+  name: vault-db
 data:
   # property-like keys; each key maps to a simple value
   POSTGRES_USER: swh
-  POSTGRES_DB: swh-scheduler
+  POSTGRES_DB: swh
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: scheduler-db
+  name: vault-db
   labels:
-    app: scheduler-db
+    app: vault-db
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: scheduler-db
+      app: vault-db
   template:
     metadata:
       labels:
-        app: scheduler-db
+        app: vault-db
     spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - parasilo-19.rennes.grid5000.fr
       containers:
-      - name: scheduler-db
+      - name: vault-db
         image: postgres:13.0
         imagePullPolicy: Always
         ports:
         - containerPort: 5432
         args:
           - "-c"
-          - "shared_buffers=5GB"
+          - "shared_buffers=256MB"
           - "-c"
-          - "effective_cache_size=512MB"
+          - "effective_cache_size=256MB"
           - "-c"
           - "random_page_cost=1.5"
           - "-c"
-          - "max_wal_size=1GB"
+          - "max_wal_size=256MB"
         env:
           - name: POSTGRES_USER
             valueFrom:
               configMapKeyRef:
-                name: scheduler-db
+                name: vault-db
                 key: POSTGRES_USER
           - name: POSTGRES_PASSWORD
             valueFrom:
               secretKeyRef:
-                name: scheduler-db
+                name: vault-db
                 key: POSTGRES_PASSWORD
           - name: POSTGRES_DB
             valueFrom:
               configMapKeyRef:
-                name: scheduler-db
+                name: vault-db
                 key: POSTGRES_DB
         volumeMounts:
         - mountPath: "/var/lib/postgresql/data"
-          name: scheduler-db-pvc
+          name: vault-db-pvc
         resources:
           requests:
-            memory: "5Gi"
-            cpu: "2000m"
+            memory: "256Mi"
+            cpu: "100m"
           limits:
-            memory: "10Gi"
-            cpu: "5000m"
+            memory: "512Mi"
+            cpu: "250m"
       volumes:
-        - name: scheduler-db-pvc
+        - name: vault-db-pvc
           persistentVolumeClaim:
-            claimName: scheduler-db-pvc
+            claimName: vault-db-pvc
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: scheduler-db
+  name: vault-db
 spec:
   type: ClusterIP
   selector:
-    app: scheduler-db
+    app: vault-db
   ports:
     - port: 5432
       targetPort: 5432
diff --git a/sysadmin/grid5000/cassandra/kubernetes/20-scheduler.yml b/sysadmin/grid5000/cassandra/kubernetes/81-vault.yml
similarity index 54%
copy from sysadmin/grid5000/cassandra/kubernetes/20-scheduler.yml
copy to sysadmin/grid5000/cassandra/kubernetes/81-vault.yml
index 82f4159..ed93716 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/20-scheduler.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/81-vault.yml
@@ -1,212 +1,273 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: scheduler
+  name: vault
 data:
   config.yml: |
-    scheduler:
+    vault:
       cls: local
-      db: postgresql:///?service=swh-scheduler
-
-    celery:
-      task_broker: amqp://guest:guest@amqp/%2f
-      broker_transport_options:
-        max_retries: 1
+      db: postgresql:///?service=swh
+    cache:
+      cls: pathslicing
+      root: /srv/softwareheritage/vault
+      slicing: 0:5
+    storage:
+      cls: remote
+      url: http://storage:5002/
+    scheduler:
+      cls: remote
+      url: http://scheduler:5008/
   entrypoint-init-db.sh: |
     #!/bin/bash
 
     set -e
 
-    echo -n "waiting for database availability"
-    set +e
-    ko=1
-    while [[ $ko -gt 0 ]]; do PGCONNECT_TIMEOUT=2 psql --list &>/dev/null;ko=$?; echo -n .; sleep 0.5; done
-    echo
-    set -e
-
-    echo Init swh-scheduler database
+    source /srv/softwareheritage/utils/pgsql.sh
+    wait_pgsql ${PGDATABASE}
 
+    echo Init swh-vault database
     echo Creating extensions...
-    swh db init-admin --db-name ${PGDATABASE} scheduler
+    swh db init-admin --db-name ${PGDATABASE} vault
 
     echo Initializing the database...
-    swh db init --db-name ${PGDATABASE} scheduler
+    swh db init --db-name ${PGDATABASE} vault
+
   entrypoint.sh: |
     #!/bin/bash
 
     set -e
 
     echo "${PGHOST}:5432:${PGDATABASE}:${PGUSER}:${PGPASSWORD}" >> ~/.pgpass
     cat >> ~/.pg_service.conf <<EOF
     [${PGDATABASE}]
     dbname=${PGDATABASE}
     host=${PGHOST}
     port=5432
     user=${PGUSER}
     EOF
 
-    echo Starting the swh-scheduler API server
-    exec gunicorn --bind 0.0.0.0:5008 \
-         --log-level ${LOGLEVEL} \
-         --threads 4 \
-         --workers 2 \
-         --reload \
-         --timeout 3600 \
-         --config 'python:swh.core.api.gunicorn_config' \
-         'swh.scheduler.api.server:make_app_from_configfile()'
+    # source /srv/softwareheritage/utils/pgsql.sh
+    # setup_pgsql
+
+    echo Starting the swh-vault API server
+    exec swh vault rpc-serve -C ${SWH_CONFIG_FILENAME}
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: vault-cache-pv
+spec:
+  capacity:
+    storage: 10Gi
+  volumeMode: Filesystem
+  accessModes:
+  - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Delete
+  storageClassName: vault-cache-pv
+  local:
+    path: /srv/data/softwareheritage-kube/vault-cache
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        # TODO adapt for your needs
+        - key: storage
+          operator: In
+          values:
+          - 'true'
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vault-cache-pvc
+spec:
+  accessModes:
+  - ReadWriteOnce
+  storageClassName: vault-cache-pv
+  resources:
+    requests:
+      storage: 10Gi
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: scheduler
+  name: vault
   labels:
-    app: scheduler
+    app: vault
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: scheduler
+      app: vault
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
-        app: scheduler
+        app: vault
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: kubernetes.io/hostname
+              - key: storage
                 operator: In
                 values:
-                - parasilo-19.rennes.grid5000.fr
+                - 'true'
       initContainers:
-        - name: scheduler-init
-          image: vsellier/swh-base
+        - name: vault-init
+          image: vsellier/swh-base:latest
           imagePullPolicy: Always
           command:
             - /entrypoint.sh
           env:
           - name: PGHOST
-            value: "scheduler-db"
+            value: "vault-db"
           - name: PGUSER
             valueFrom:
               configMapKeyRef:
-                name: scheduler-db
+                name: vault-db
                 key: POSTGRES_USER
           - name: PGPASSWORD
             valueFrom:
               secretKeyRef:
-                name: scheduler-db
+                name: vault-db
                 key: POSTGRES_PASSWORD
           - name: PGDATABASE
             valueFrom:
               configMapKeyRef:
-                name: scheduler-db
+                name: vault-db
                 key: POSTGRES_DB
           - name: SWH_CONFIG_FILENAME
             value: /etc/softwareheritage/config.yml
           volumeMounts:
             - name: db-password
               mountPath: /run/secrets/postgres-password
               subPath: POSTGRES_PASSWORD
               readOnly: true
             - name: config
               mountPath: /etc/softwareheritage/config.yml
               subPath: config.yml
               readOnly: true
             - name: config
               mountPath: /entrypoint.sh
               subPath: entrypoint-init-db.sh
               readOnly: true
       containers:
-      - name: scheduler
-        image: vsellier/swh-base
+      - name: vault
+        image: vsellier/swh-base:latest
         imagePullPolicy: Always
         command:
           - /entrypoint.sh
         ports:
-        - containerPort: 5008
+        - containerPort: 5005
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 5005
+            scheme: "HTTP"
+          initialDelaySeconds: 0
+          failureThreshold: 2
+          periodSeconds: 10
+        startupProbe:
+          httpGet:
+            path: /
+            port: 5005
+            scheme: "HTTP"
+          initialDelaySeconds: 5
+          failureThreshold: 30
+          periodSeconds: 1
         env:
         - name: PORT
-          value: "5008"
+          value: "5005"
         - name: STATSD_HOST
           value: "prometheus-statsd-exporter"
         - name: STATSD_PORT
           value: "9125"
+        - name: POSTGRES_PASSWORD_FILE
+          value: "/run/secrets/postgres-password"
         - name: PGHOST
-          value: "scheduler-db"
+          value: "vault-db"
         - name: PGUSER
           valueFrom:
             configMapKeyRef:
-              name: scheduler-db
+              name: vault-db
               key: POSTGRES_USER
         - name: PGPASSWORD
           valueFrom:
             secretKeyRef:
-              name: scheduler-db
+              name: vault-db
               key: POSTGRES_PASSWORD
         - name: PGDATABASE
           valueFrom:
             configMapKeyRef:
-              name: scheduler-db
+              name: vault-db
               key: POSTGRES_DB
         - name: SWH_CONFIG_FILENAME
           value: /etc/softwareheritage/config.yml
-        - name: LOGLEVEL
-          value: INFO
         volumeMounts:
           - name: db-password
             mountPath: /run/secrets/postgres-password
             subPath: POSTGRES_PASSWORD
             readOnly: true
           - name: config
             mountPath: /etc/softwareheritage/config.yml
             subPath: config.yml
             readOnly: true
           - name: config
             mountPath: /entrypoint.sh
             subPath: entrypoint.sh
             readOnly: true
+          - name: vault-cache-pvc
+            mountPath: "/srv/softwareheritage/vault"
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "200m"
+          limits:
+            memory: "1536Mi"
+            cpu: "300m"
       volumes:
         - name: config
           configMap:
-            name: scheduler
+            name: vault
             defaultMode: 0777
         - name: db-password
           secret:
-            secretName: scheduler-db
+            secretName: vault-db
+        - name: vault-cache-pvc
+          persistentVolumeClaim:
+            claimName: vault-cache-pvc
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: scheduler
+  name: vault
 spec:
   type: ClusterIP
   selector:
-    app: scheduler
+    app: vault
   ports:
-    - port: 5008
-      targetPort: 5008
+    - port: 5005
+      targetPort: 5005
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: scheduler
+  name: vault
 spec:
   rules:
-  - host: scheduler.default
+  - host: vault.default
     http:
       paths:
       - path: /
         pathType: Prefix
         backend:
           service:
-            name: scheduler
+            name: vault
             port:
-              number: 5008
+              number: 5005
diff --git a/sysadmin/grid5000/cassandra/kubernetes/40-loaders.yml b/sysadmin/grid5000/cassandra/kubernetes/82-cookers.yml
similarity index 57%
copy from sysadmin/grid5000/cassandra/kubernetes/40-loaders.yml
copy to sysadmin/grid5000/cassandra/kubernetes/82-cookers.yml
index 6955582..f063211 100644
--- a/sysadmin/grid5000/cassandra/kubernetes/40-loaders.yml
+++ b/sysadmin/grid5000/cassandra/kubernetes/82-cookers.yml
@@ -1,162 +1,139 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: loaders
+  name: cookers
 data:
   config.yml: |
     storage:
-      cls: pipeline
-      steps:
-      - cls: buffer
-        min_batch_size:
-          content: 500
-          content_bytes: 104857600
-          directory: 1000
-          revision: 50
-      - cls: filter
-      - cls: retry
-      - cls: remote
-        url: http://storage:5002/
-    max_content_size: 104857600
-    temp_file_cutoff: 536870912
+      cls: remote
+      url: http://storage:5002/
+    vault:
+      cls: remote
+      url: http://vault:5005/
     celery:
-      task_ignore_result: True
       task_broker: amqp://guest:guest@amqp//
+      task_modules:
+        - swh.vault.cooking_tasks
       task_queues:
-       - swh.loader.dir.tasks.LoadDirRepository
-       - swh.loader.git.tasks.LoadDiskGitRepository
-       - swh.loader.git.tasks.UncompressAndLoadDiskGitRepository
-       - swh.loader.git.tasks.UpdateGitRepository
-       - swh.loader.package.archive.tasks.LoadArchive
-       - swh.loader.package.cran.tasks.LoadCRAN
-       - swh.loader.package.debian.tasks.LoadDebian
-       - swh.loader.package.npm.tasks.LoadNpm
-       - swh.loader.package.pypi.tasks.LoadPyPI
+        - swh.vault.cooking_tasks.SWHBatchCookingTask
+        - swh.vault.cooking_tasks.SWHCookingTask
+
+    max_bundle_size: 536870912
 
-       - save_code_now:swh.loader.git.tasks.UpdateGitRepository
-       # - swh.loader.mercurial.tasks.LoadArchiveMercurial
-       # - swh.loader.mercurial.tasks.LoadMercurial
-       # - swh.loader.svn.tasks.DumpMountAndLoadSvnRepository
-       # - swh.loader.svn.tasks.LoadSvnRepository
-       # - swh.loader.svn.tasks.MountAndLoadSvnRepository
   entrypoint-init.sh: |
     #!/bin/bash
 
     set -e
 
     # echo Waiting for RabbitMQ to start
     wait-for-it amqp:5672 -s --timeout=0
 
     # echo Register task types in scheduler database
     wait-for-it scheduler:5008 -s --timeout=0
-
     swh scheduler --url http://scheduler:5008 task-type register
+
+    # Wait for services to be up
+    wait-for-it vault:5005 -s --timeout=0
+    wait-for-it storage:5002 -s --timeout=0
+
   entrypoint.sh: |
     #!/bin/bash
 
     set -e
 
-    echo Starting the swh Celery worker
+    echo Starting the swh-vault Celery worker
     exec python -m celery \
                 --app=swh.scheduler.celery_backend.config.app \
                 worker \
-                --pool=prefork \
+                --pool=prefork --events \
                 --concurrency=${CONCURRENCY} \
                 --max-tasks-per-child=${MAX_TASKS_PER_CHILD} \
                 -Ofair --loglevel=${LOGLEVEL} \
                 --hostname "${HOSTNAME}"
 
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: loaders
+  name: cookers
   labels:
-    app: loaders
+    app: cookers
 spec:
-  replicas: 100
+  replicas: 1
   selector:
     matchLabels:
-      app: loaders
+      app: cookers
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
-        app: loaders
+        app: cookers
     spec:
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: type
+              - key: worker
                 operator: In
                 values:
-                - loader   
+                - 'true'
       initContainers:
-        - name: loaders-init
-          image: vsellier/swh-base
+        - name: cookers-init
+          image: vsellier/swh-base:latest
           imagePullPolicy: Always
           command:
             - /entrypoint.sh
           volumeMounts:
             - name: config
               mountPath: /etc/softwareheritage/config.yml
               subPath: config.yml
               readOnly: true
             - name: config
               mountPath: /entrypoint.sh
               subPath: entrypoint-init.sh
               readOnly: true
       containers:
-      - name: loaders
-        image: vsellier/swh-base
+      - name: cookers
+        image: vsellier/swh-base:latest
         imagePullPolicy: Always
         command:
           - /entrypoint.sh
-        ports:
-        - containerPort: 5002
         resources:
           requests:
-            memory: "2000Mi"
-            cpu: "500m"
+            memory: "256Mi"
+            cpu: "200m"
           limits:
-            memory: "4000Mi"
-            cpu: "1000m"
+            memory: "3000Mi"
+            cpu: "1200m"
         lifecycle:
           preStop:
            exec:
              command: ["kill", "1"]
         env:
         - name: CONCURRENCY
           value: "1"
         - name: MAX_TASKS_PER_CHILD
           value: "5"
         - name: LOGLEVEL
           value: "INFO"
         - name: SWH_CONFIG_FILENAME
           value: /etc/softwareheritage/config.yml
-        - name: TMPDIR
-          value: /srv/tmp
         volumeMounts:
           - name: config
             mountPath: /etc/softwareheritage/config.yml
             subPath: config.yml
             readOnly: true
           - name: config
             mountPath: /entrypoint.sh
             subPath: entrypoint.sh
             readOnly: true
-          - name: tmp
-            mountPath: /srv/tmp
       volumes:
         - name: config
           configMap:
-            name: loaders
+            name: cookers
             defaultMode: 0777
-        - name: tmp
-          emptyDir: {}