diff --git a/proxmox/terraform/admin/admin.tf b/proxmox/terraform/admin/admin.tf
index 3b16c9a..89fe534 100644
--- a/proxmox/terraform/admin/admin.tf
+++ b/proxmox/terraform/admin/admin.tf
@@ -1,212 +1,212 @@
 locals {
   config = {
     dns                             = var.dns
     domain                          = "internal.admin.swh.network"
     puppet_environment              = "production"
     facter_deployment               = "admin"
     facter_subnet                   = "sesi_rocquencourt_admin"
     puppet_master                   = var.puppet_master
     gateway_ip                      = "192.168.50.1"
     user_admin                      = var.user_admin
     user_admin_ssh_public_key       = var.user_admin_ssh_public_key
     user_admin_ssh_private_key_path = var.user_admin_ssh_private_key_path
     vlan                            = "vmbr442"
   }
 }
 
 module "bardo" {
   source = "../modules/node"
   config = local.config
 
   hostname    = "bardo"
   description = "Hedgedoc instance"
   hypervisor  = "branly"
   vmid        = 124
   cores       = "2"
   memory      = "8192"
   balloon     = 1024
   full_clone  = true
   networks = [{
     id      = 0
     ip      = "192.168.50.10"
     gateway = local.config["gateway_ip"]
     macaddr = "7A:CE:A2:72:FA:E8"
     bridge  = local.config["vlan"]
   }]
 }
 
 
 module "rp1" {
   source = "../modules/node"
   config = local.config
 
   hostname    = "rp1"
   description = "reverse-proxy"
   hypervisor  = "branly"
   vmid        = 115
   cores       = 2
   memory      = 4096
   balloon     = 1024
   full_clone  = true
   networks = [{
     id      = 0
     ip      = "192.168.50.20"
     gateway = local.config["gateway_ip"]
     macaddr = "4E:42:20:E0:B6:65"
     bridge  = local.config["vlan"]
    }]
 }
 
 
 module "dali" {
   source = "../modules/node"
   config = local.config
 
-  template    = "debian-bullseye-11.2-2022-01-03"
+  template    = var.templates["stable"]
   hostname    = "dali"
   description = "admin databases host"
   hypervisor  = "branly"
   vmid        = 144
   cores       = 4
   memory      = 16384
   balloon     = 8192
   networks = [{
     id      = 0
     ip      = "192.168.50.50"
     gateway = local.config["gateway_ip"]
     macaddr = "C2:7C:85:D0:E8:7C"
     bridge  = local.config["vlan"]
    }]
   storages = [
     {
       id      = 0
       storage = "proxmox"
       size    = "32G"
     },
     {
       id      = 1
       storage = "proxmox"
       size    = "200G"
     }
   ]
 }
 
 output "dali_summary" {
   value = module.dali.summary
 }
 
 module "grafana0" {
   source = "../modules/node"
   config = local.config
 
-  template    = "debian-bullseye-11.2-2022-01-03"
+  template    = var.templates["stable"]
   hostname    = "grafana0"
   description = "Grafana server"
   hypervisor  = "branly"
   vmid        = 108
   cores       = 4
   memory      = 4096
   balloon     = 2048
   networks = [{
     id      = 0
     ip      = "192.168.50.30"
     gateway = local.config["gateway_ip"]
     macaddr = "B2:CB:D9:09:D3:3B"
     bridge  = local.config["vlan"]
   }]
 }
 
 output "grafana0_summary" {
   value = module.grafana0.summary
 }
 
 module "bojimans" {
   source = "../modules/node"
   config = local.config
 
-  template    = "debian-bullseye-11.2-2022-01-03"
+  template    = var.templates["stable"]
   hostname    = "bojimans"
   description = "Inventory server (netbox)"
   hypervisor  = "branly"
   cpu         = "kvm64"
   vmid        = 127
   sockets     = 2
   cores       = 1
   memory      = 4096
   balloon     = 2048
   networks = [{
     id      = 0
     ip      = "192.168.50.60"
     gateway = "192.168.50.1"
     macaddr = "EE:ED:A6:A0:78:9F"
     bridge  = local.config["vlan"]
   }]
   storages = [{
     id      = 0
     storage = "proxmox"
     size    = "20G"
   }]
 }
 
 output "bojimans_summary" {
   value = module.bojimans.summary
 }
 
 module "money" {
   source = "../modules/node"
   config = local.config
 
-  template    = "debian-bullseye-11.2-2022-01-03"
+  template    = var.templates["stable"]
   hostname    = "money"
   description = "Azure billing reporting server"
   hypervisor  = "branly"
   cpu         = "kvm64"
   vmid        = 140
   sockets     = 2
   cores       = 1
   memory      = 2048
   balloon     = 1024
   networks = [{
     id      = 0
     ip      = "192.168.50.65"
     gateway = "192.168.50.1"
     macaddr = ""
     bridge  = local.config["vlan"]
   }]
   storages = [{
     id      = 0
     storage = "proxmox"
     size    = "20G"
   }]
 }
 
 output "money_summary" {
   value = module.money.summary
 }
 
 module "thanos" {
   source      = "../modules/node"
   config      = local.config
   onboot      = true
-  template    = "debian-bullseye-11.2-2022-01-03"
+  template    = var.templates["stable"]
 
   hostname    = "thanos"
   description = "Thanos query service"
   hypervisor  = "branly"
   sockets     = "1"
   cores       = "4"
   memory  = "4096"
   balloon = "1024"
 
   networks = [{
     id      = 0
     ip      = "192.168.50.90"
     gateway = local.config["gateway_ip"]
     macaddr = "16:3C:72:26:70:34"
     bridge  = local.config["vlan"]
   }]
 }
 
 output "thanos_summary" {
   value = module.thanos.summary
 }
diff --git a/proxmox/terraform/modules/node/variables.tf b/proxmox/terraform/modules/node/variables.tf
index 7b97bbd..29eaa12 100644
--- a/proxmox/terraform/modules/node/variables.tf
+++ b/proxmox/terraform/modules/node/variables.tf
@@ -1,138 +1,138 @@
 variable "hostname" {
   description = "Node's hostname"
   type        = string
 }
 
 variable "domainname" {
   description = "Domain name. If empty the config domain is used as fallback."
   type        = string
   default     = ""
 }
 
 variable "description" {
   description = "Node's description"
   type        = string
 }
 
 variable "hypervisor" {
   description = "Hypervisor to install the vm to (choice: orsay, hypervisor3, beaubourg, branly)"
   type        = string
 }
 
 variable "template" {
   description = "Debian image template created by packer"
   # Note: use "buster" template for node with swh services (storage, objstorage, ...).
   # You can use latest "bullseye" templates otherwise.
   type        = string
   default     = "debian-buster-10.10-2021-09-09"
   # other possible template values:
-  # - debian-bullseye-2022-04-21
-  # - debian-bullseye-zfs-2022-04-21 (for extra zfs dependencies)
+  # - debian-bullseye-11.4-2022-07-27
+  # - debian-bullseye-11.4-zfs-2022-07-27 (for extra zfs dependencies)
 }
 
 variable "sockets" {
   description = "Number of sockets"
   type        = number
   default     = 1
 }
 
 variable "cores" {
   description = "Number of cores"
   type        = number
   default     = 1
 }
 
 variable "memory" {
   description = "Memory in Mb"
   type        = number
   default     = 1024
 }
 
 variable "networks" {
   description = "Default networks configuration (id, ip, gateway, macaddr, bridge)"
   type = list(object({
     id      = number
     ip      = string
     gateway = string
     macaddr = optional(string)
     bridge  = string
   }))
   default = []
 }
 
 
 variable "vmid" {
   description = "virtual machine id"
   type        = number
   default     = null
 }
 
 variable "balloon" {
   description = "ballooning option"
   type        = number
   default     = 0
 }
 
 variable "numa" {
   type    = bool
   default = false
 }
 
 variable "storages" {
   description = "Default disks configuration (storage, size)"
   type = list(object({
     storage = string
     size    = string
   }))
   default = [{
     storage = "proxmox"
     size    = "32G"
   }]
 }
 
 variable "config" {
   description = "Local config to avoid duplication from the main module"
   type        = map(string)
 }
 
 variable "args" {
   description = "args to pass to the qemu command. should not be used in most cases"
   type        = string
   default     = ""
 }
 
 variable "pre_provision_steps" {
   description = "Sequential provisioning steps to apply *before* common provision steps"
   type        = list(string)
   default     = []
 }
 
 variable "post_provision_steps" {
   description = "Sequential provisioning steps to apply *after* common provision steps"
   type        = list(string)
   default     = []
 }
 
 variable "cicustom" {
   description = "custom ci parameter"
   type        = string
   default     = ""
 }
 
 variable "full_clone" {
   description = "Full clone the template"
   type        = bool
   default     = false
 }
 
 variable "cpu" {
   description = "CPU type possible values (not exhaustive): kvm64, host, ... The default is kvm64 and must be specified to avoid issues on refresh"
   type        = string
   default     = "kvm64"
 }
 
 variable "onboot" {
   description = "Start the vm on hypervisor boot"
   type        = bool
   default     = true
 }
diff --git a/proxmox/terraform/production/cassandra.tf b/proxmox/terraform/production/cassandra.tf
index 1cefc5c..9cabd48 100644
--- a/proxmox/terraform/production/cassandra.tf
+++ b/proxmox/terraform/production/cassandra.tf
@@ -1,166 +1,166 @@
 # Provision the rancher cluster for the cassandra
 # nodes in production
 #
 # Provision 3 vms in proxmox to manage the etcd cluster
 # and the kubernetes control plane
 
 provider "rancher2" {
   api_url    = "https://rancher.euwest.azure.internal.softwareheritage.org/v3"
   insecure = true
 }
 
 resource "rancher2_cluster" "production_cassandra" {
   name = "production-cassandra"
   description = "Production - Cassandra cluster"
   rke_config {
     kubernetes_version = "v1.22.10-rancher1-1"
     network {
       plugin = "canal"
     }
     services {
       kubelet {
         extra_binds = [
           "/srv/prometheus:/srv/prometheus", # prometheus datastore on mngmt nodes
           "/srv/cassandra_commitlog:/srv/cassandra_commitlog", # writeintensive disks
           "/srv/cassandra_data:/srv/cassandra_data", # mixeduse disks
         ]
       }
     }
   }
 }
 
 output "production_cassandra_cluster_summary" {
   sensitive = true
   value     = rancher2_cluster.production_cassandra.kube_config
 }
 
 output "production_cassandra_cluster_command" {
   sensitive = true
   value     = rancher2_cluster.production_cassandra.cluster_registration_token[0].node_command
 }
 
 module "rancher_node_cassandra1" {
   hostname = "rancher-node-cassandra1"
 
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   description = "Kubernetes management node for cassandra cluster"
   hypervisor  = "beaubourg"
   vmid        = 159
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.100.178"
     gateway = local.config["gateway_ip"]
     macaddr = ""
     bridge  = "vmbr0"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker", # workaround
     "${rancher2_cluster.production_cassandra.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "rancher_node_cassandra1_summary" {
   value = module.rancher_node_cassandra1.summary
 }
 
 module "rancher_node_cassandra2" {
   hostname = "rancher-node-cassandra2"
 
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   description = "Kubernetes management node for cassandra cluster"
   hypervisor  = "branly"
   vmid        = 160
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.100.179"
     gateway = local.config["gateway_ip"]
     macaddr = ""
     bridge  = "vmbr0"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker", # workaround
     "${rancher2_cluster.production_cassandra.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "rancher_node_cassandra2_summary" {
   value = module.rancher_node_cassandra2.summary
 }
 
 module "rancher_node_cassandra3" {
   hostname = "rancher-node-cassandra3"
 
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   description = "Kubernetes management node for cassandra cluster"
   hypervisor  = "hypervisor3"
   vmid        = 161
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.100.180"
     gateway = local.config["gateway_ip"]
     macaddr = ""
     bridge  = "vmbr0"
  }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker", # workaround
     "${rancher2_cluster.production_cassandra.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "rancher_node_cassandra3_summary" {
   value = module.rancher_node_cassandra3.summary
 }
diff --git a/proxmox/terraform/production/production.tf b/proxmox/terraform/production/production.tf
index 2f75610..a43c47d 100644
--- a/proxmox/terraform/production/production.tf
+++ b/proxmox/terraform/production/production.tf
@@ -1,186 +1,186 @@
 locals {
   config = {
     dns                             = var.dns
     domain                          = "internal.softwareheritage.org"
     puppet_environment              = "production"
     facter_deployment               = "production"
     facter_subnet                   = "sesi_rocquencourt"
     puppet_master                   = var.puppet_master
     gateway_ip                      = "192.168.100.1"
     user_admin                      = var.user_admin
     user_admin_ssh_public_key       = var.user_admin_ssh_public_key
     user_admin_ssh_private_key_path = var.user_admin_ssh_private_key_path
   }
 }
 
 module "kelvingrove" {
   source = "../modules/node"
   config = local.config
 
   hostname    = "kelvingrove"
   description = "Keycloak server"
   hypervisor  = "hypervisor3"
   cores       = "4"
   memory      = "8192"
   cpu         = "host"
   numa        = true
   balloon     = 0
   networks = [{
     id      = 0
     ip      = "192.168.100.106"
     gateway = local.config["gateway_ip"]
     macaddr = "72:55:5E:58:01:0B"
     bridge  = "vmbr0"
   }]
 }
 
 module "webapp1" {
   source = "../modules/node"
   config = local.config
 
   hostname    = "webapp1"
   description = "Webapp for swh-search tests"
   hypervisor  = "branly"
   cores       = "2"
   memory      = "8192"
   balloon     = 2048
   networks = [{
     id      = 0
     ip      = "192.168.100.71"
     gateway = local.config["gateway_ip"]
     macaddr = "06:FF:02:95:31:CF"
     bridge  = "vmbr0"
   }]
 }
 
 module "search1" {
   source = "../modules/node"
   config = local.config
 
   hostname    = "search1"
   description = "swh-search node"
   hypervisor  = "branly"
   cores       = "4"
   memory      = "6144"
   balloon     = 1024
   networks = [{
     id      = 0
     ip      = "192.168.100.85"
     gateway = local.config["gateway_ip"]
     macaddr = "3E:46:D3:88:44:F4"
     bridge  = "vmbr0"
   }]
 }
 
 module "counters1" {
   source = "../modules/node"
   config = local.config
 
   hostname    = "counters1"
   description = "swh-counters node"
   hypervisor  = "branly"
   cores       = "4"
   memory      = "2048"
   balloon     = 1024
   networks = [{
     id      = 0
     ip      = "192.168.100.95"
     gateway = local.config["gateway_ip"]
     macaddr = "26:8E:7F:D1:F7:99"
     bridge  = "vmbr0"
   }]
 }
 
 module "worker17" {
   source = "../modules/node"
   config = local.config
 
   hostname    = "worker17"
   domainname  = "softwareheritage.org"
   description = "swh-worker node (temporary)"
   hypervisor  = "uffizi"
   cores       = "5"
   sockets     = "2"
   memory      = "49152"
   balloon     = 1024
   networks = [{
     id      = 0
     ip      = "192.168.100.43"
     gateway = local.config["gateway_ip"]
     macaddr = "36:E0:2D:70:7C:52"
     bridge  = "vmbr0"
   }]
 }
 
 module "worker18" {
   source = "../modules/node"
   config = local.config
 
   hostname    = "worker18"
   domainname  = "softwareheritage.org"
   description = "swh-worker node (temporary)"
   hypervisor  = "uffizi"
   cores       = "5"
   sockets     = "2"
   memory      = "49152"
   balloon     = 1024
   networks = [{
     id      = 0
     ip      = "192.168.100.44"
     gateway = local.config["gateway_ip"]
     macaddr = "C6:29:D9:ED:9C:6B"
     bridge  = "vmbr0"
   }]
 }
 
 output "worker18_summary" {
   value = module.worker18.summary
 }
 
 module "provenance-client01" {
   source = "../modules/node"
   config = local.config
 
   hostname    = "provenance-client01"
   description = "Provenance client"
-  template    = "debian-bullseye-11.2-2022-01-03"
+  template    = var.templates["stable"]
   hypervisor  = "uffizi"
   cores       = "4"
   sockets     = "4"
   memory      = "131072"
   balloon     = 32768
   networks = [{
     id      = 0
     ip      = "192.168.100.111"
     gateway = local.config["gateway_ip"]
     macaddr = null
     bridge  = "vmbr0"
   }]
 }
 
 module "scrubber1" {
   source      = "../modules/node"
   config      = local.config
   vmid        = 153
   onboot      = true
 
   hostname    = "scrubber1"
   description = "Scrubber checker services"
   hypervisor  = "branly"
   sockets     = "1"
   cores       = "4"
   memory  = "4096"
   balloon = "1024"
 
   networks = [{
     id      = 0
     ip      = "192.168.100.90"
     gateway = local.config["gateway_ip"]
     macaddr = "B2:E5:3F:E2:77:13"
     bridge  = "vmbr0"
   }]
 }
 
 output "scrubber1_summary" {
   value = module.scrubber1.summary
 }
diff --git a/proxmox/terraform/staging/cluster-elastic-workers.tf b/proxmox/terraform/staging/cluster-elastic-workers.tf
index 266e91f..a7d99b3 100644
--- a/proxmox/terraform/staging/cluster-elastic-workers.tf
+++ b/proxmox/terraform/staging/cluster-elastic-workers.tf
@@ -1,215 +1,215 @@
 # Plan:
 # - create cluster with terraform
 # - Create nodes as usual through terraform
 # - Retrieve the registration command (out of the cluster creation step) to provide new
 #   node
 
 resource "rancher2_cluster" "staging-workers" {
   name = "staging-workers"
   description = "staging workers cluster"
   rke_config {
     network {
       plugin = "canal"
     }
   }
 }
 
 output "rancher2_cluster_staging_workers_summary" {
   sensitive = true
   value = rancher2_cluster.staging-workers.kube_config
 }
 
 output "rancher2_cluster_staging_worker_command" {
   sensitive = true
   value = rancher2_cluster.staging-workers.cluster_registration_token[0].node_command
 }
 
 module "elastic-worker0" {
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   vmid        = 146
   config      = local.config
   hostname    = "elastic-worker0"
   description = "elastic worker running in rancher cluster"
   hypervisor  = "uffizi"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.130"
     gateway = local.config["gateway_ip"]
     macaddr = "72:CF:A9:AC:B8:EE"
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker",  # workaround
     "${rancher2_cluster.staging-workers.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "elastic-worker0_summary" {
   value = module.elastic-worker0.summary
 }
 
 module "elastic-worker1" {
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   hostname    = "elastic-worker1"
   description = "elastic worker running in rancher cluster"
   hypervisor  = "uffizi"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.131"
     gateway = local.config["gateway_ip"]
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker",  # workaround
     "${rancher2_cluster.staging-workers.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "elastic-worker1_summary" {
   value = module.elastic-worker1.summary
 }
 
 module "elastic-worker2" {
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   hostname    = "elastic-worker2"
   description = "elastic worker running in rancher cluster"
   hypervisor  = "uffizi"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.132"
     gateway = local.config["gateway_ip"]
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker",  # workaround
     "${rancher2_cluster.staging-workers.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "elastic-worker2_summary" {
   value = module.elastic-worker2.summary
 }
 
 module "elastic-worker3" {
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   hostname    = "elastic-worker3"
   description = "elastic worker running in rancher cluster"
   hypervisor  = "pompidou"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.133"
     gateway = local.config["gateway_ip"]
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker",  # workaround
     "${rancher2_cluster.staging-workers.cluster_registration_token[0].node_command} --worker"
   ]
 }
 
 output "elastic-worker3_summary" {
   value = module.elastic-worker3.summary
 }
 
 resource "rancher2_app_v2" "rancher-monitoring" {
   cluster_id = rancher2_cluster.staging-workers.id
   name = "rancher-monitoring"
   namespace = "cattle-monitoring-system"
   repo_name = "rancher-charts"
   chart_name = "rancher-monitoring"
   # chart_version = "9.4.200"
   chart_version = "100.1.0+up19.0.3"
   values = <<EOF
 prometheus:
   prometheusSpec:
     requests:
       cpu: "250m"
       memory: "250Mi"
 EOF
 }
 
 resource "rancher2_catalog_v2" "keda" {
   cluster_id = rancher2_cluster.staging-workers.id
   name       = "keda"
   url        = "https://kedacore.github.io/charts/"
 }
 
 resource "rancher2_app_v2" "keda" {
   cluster_id = rancher2_cluster.staging-workers.id
   name = "keda"
   namespace = "kedacore"
   repo_name = "keda"
   chart_name = "keda"
   chart_version = "2.6.2"
 }
diff --git a/proxmox/terraform/staging/cluster-graphql.tf b/proxmox/terraform/staging/cluster-graphql.tf
index f5938bf..e91c327 100644
--- a/proxmox/terraform/staging/cluster-graphql.tf
+++ b/proxmox/terraform/staging/cluster-graphql.tf
@@ -1,159 +1,159 @@
 # This declares terraform manifests to provision vms and register containers within
 # those to a rancher (clusters management service) instance.
 
 # Each software has the following responsibilities:
 # - proxmox: provision vms (with docker dependency)
 # - rancher: installs kube cluster within containers (running on vms)
 
 # Requires (RANCHER_ACCESS_KEY and RANCHER_SECRET_KEY) in your shell environment
 # $ cat ~/.config/terraform/swh/setup.sh
 # ...
 # key_entry=operations/rancher/azure/elastic-loader-lister-keys
 # export RANCHER_ACCESS_KEY=$(swhpass ls $key_entry | head -1 | cut -d: -f1)
 # export RANCHER_SECRET_KEY=$(swhpass ls $key_entry | head -1 | cut -d: -f2)
 
 # Plan:
 # - create cluster with terraform
 # - Create nodes as usual through terraform
 # - Retrieve the registration command (out of the cluster creation step) to provide new
 #   node
 
 resource "rancher2_cluster" "cluster-graphql" {
   name = "cluster-graphql"
   description = "graphql staging cluster"
   rke_config {
     network {
       plugin = "canal"
     }
   }
 }
 
 output "rancher2_cluster_graphql_summary" {
   sensitive = true
   value = rancher2_cluster.cluster-graphql.kube_config
 }
 
 output "rancher2_cluster_graphql_command" {
   sensitive = true
   value = rancher2_cluster.cluster-graphql.cluster_registration_token[0].node_command
 }
 
 module "graphql-worker0" {
   source      = "../modules/node"
   vmid        = 162
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   hostname    = "graphql-worker0"
   description = "elastic worker running in rancher cluster"
   hypervisor  = "uffizi"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.150"
     gateway = local.config["gateway_ip"]
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker",  # workaround
     "${rancher2_cluster.cluster-graphql.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "graphql-worker0_summary" {
   value = module.graphql-worker0.summary
 }
 
 module "graphql-worker1" {
   source      = "../modules/node"
   vmid        = 163
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   hostname    = "graphql-worker1"
   description = "graphql worker running in rancher cluster"
   hypervisor  = "uffizi"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.151"
     gateway = local.config["gateway_ip"]
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker",  # workaround
     "${rancher2_cluster.cluster-graphql.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "graphql-worker1_summary" {
   value = module.graphql-worker1.summary
 }
 
 module "graphql-worker2" {
   source      = "../modules/node"
   vmid        = 164
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   hostname    = "graphql-worker2"
   description = "graphql worker running in rancher cluster"
   hypervisor  = "uffizi"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.152"
     gateway = local.config["gateway_ip"]
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker",  # workaround
     "${rancher2_cluster.cluster-graphql.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "graphql-worker2_summary" {
   value = module.graphql-worker2.summary
 }
diff --git a/proxmox/terraform/staging/cluster-internship.tf b/proxmox/terraform/staging/cluster-internship.tf
index 7eae031..cc061e3 100644
--- a/proxmox/terraform/staging/cluster-internship.tf
+++ b/proxmox/terraform/staging/cluster-internship.tf
@@ -1,146 +1,146 @@
 # - Create a rancher cluster
 # - Create 3 compute nodes
 resource "rancher2_cluster" "deployment_internship" {
   name        = "deployment-internship"
   description = "staging cluster for deployment test"
 
   rke_config {
     kubernetes_version = "v1.21.12-rancher1-1"
     network {
       plugin = "canal"
     }
   }
 }
 
 output "deployment_internship_cluster_summary" {
   sensitive = true
   value     = rancher2_cluster.deployment_internship.kube_config
 }
 
 output "deployment_internship_cluster_command" {
   sensitive = true
   value     = rancher2_cluster.deployment_internship.cluster_registration_token[0].node_command
 }
 
 module "rancher_node_internship0" {
   hostname = "rancher-node-intership0"
 
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   description = "Rancher node for the internship"
   hypervisor  = "uffizi"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.140"
     gateway = local.config["gateway_ip"]
     macaddr = ""
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker", # workaround
     "${rancher2_cluster.deployment_internship.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "rancher_node_internship0_summary" {
   value = module.rancher_node_internship0.summary
 }
 
 module "rancher_node_internship1" {
   hostname = "rancher-node-intership1"
 
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   description = "Rancher node for the internship"
   hypervisor  = "uffizi"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.141"
     gateway = local.config["gateway_ip"]
     macaddr = ""
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker", # workaround
     "${rancher2_cluster.deployment_internship.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "rancher_node_internship1_summary" {
   value = module.rancher_node_internship1.summary
 }
 
 module "rancher_node_internship2" {
   hostname = "rancher-node-intership2"
 
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-zfs-2022-04-21"
+  template    = var.templates["stable-zfs"]
   config      = local.config
   description = "Rancher node for the internship"
   hypervisor  = "uffizi"
   sockets     = "1"
   cores       = "4"
   onboot      = true
   memory      = "8192"
   balloon     = "4096"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.142"
     gateway = local.config["gateway_ip"]
     macaddr = ""
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 
   post_provision_steps = [
     "systemctl restart docker", # workaround
     "${rancher2_cluster.deployment_internship.cluster_registration_token[0].node_command} --etcd --controlplane --worker"
   ]
 }
 
 output "rancher_node_internship2_summary" {
   value = module.rancher_node_internship2.summary
 }
diff --git a/proxmox/terraform/staging/staging.tf b/proxmox/terraform/staging/staging.tf
index 5769dd9..6eea701 100644
--- a/proxmox/terraform/staging/staging.tf
+++ b/proxmox/terraform/staging/staging.tf
@@ -1,465 +1,465 @@
 # Keyword use:
 # - provider: Define the provider(s)
 # - data: Retrieve data information to be used within the file
 # - resource: Define resource and create/update
 
 # Default configuration passed along module calls
 # (There is no other way to avoid duplication)
 locals {
   config = {
     dns                             = var.dns
     domain                          = var.domain
     puppet_environment              = var.puppet_environment
     facter_deployment               = "staging"
     facter_subnet                   = "sesi_rocquencourt_staging"
     puppet_master                   = var.puppet_master
     gateway_ip                      = var.gateway_ip
     user_admin                      = var.user_admin
     user_admin_ssh_public_key       = var.user_admin_ssh_public_key
     user_admin_ssh_private_key_path = var.user_admin_ssh_private_key_path
   }
 }
 
 
 module "scheduler0" {
   source = "../modules/node"
   config = local.config
 
   vmid        = 116
   hostname    = "scheduler0"
   description = "Scheduler api services"
   hypervisor  = "beaubourg"
   # to match the real vm configuration in proxmox
   # to remove
   args    = "-device virtio-rng-pci"
   cores   = 4
   memory  = 8192
   balloon = 1024
   networks = [{
     id      = 0
     ip      = "192.168.130.50"
     gateway = local.config["gateway_ip"]
     macaddr = "92:02:7E:D0:B9:36"
     bridge  = "vmbr443"
   }]
 }
 
 output "scheduler0_summary" {
   value = module.scheduler0.summary
 }
 
 module "worker0" {
   source = "../modules/node"
   config = local.config
 
   vmid        = 117
   hostname    = "worker0"
   description = "Loader/lister service node"
   hypervisor  = "beaubourg"
   cores       = "4"
   memory      = 24576
   balloon     = 4096
   onboot      = false
   args        = "-device virtio-rng-pci"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.100"
     gateway = local.config["gateway_ip"]
     macaddr = "72:D9:03:46:B1:47"
     bridge  = "vmbr443"
   }]
 }
 
 output "worker0_summary" {
   value = module.worker0.summary
 }
 
 module "worker1" {
   source = "../modules/node"
   config = local.config
 
   vmid        = 118
   hostname    = "worker1"
   description = "Loader/lister service node"
   hypervisor  = "beaubourg"
   cores       = "4"
   memory      = 24576
   balloon     = 4096
   onboot      = false
   args        = "-device virtio-rng-pci"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.101"
     gateway = local.config["gateway_ip"]
     macaddr = "D6:A9:6F:02:E3:66"
     bridge  = "vmbr443"
   }]
 }
 
 output "worker1_summary" {
   value = module.worker1.summary
 }
 
 module "worker2" {
   source = "../modules/node"
   config = local.config
 
   vmid        = 112
   hostname    = "worker2"
   description = "Loader/lister service node"
   hypervisor  = "branly"
   cores       = 4
   memory      = 24576
   balloon     = 4096
   onboot      = false
 
   networks = [{
     id      = 0
     ip      = "192.168.130.102"
     gateway = local.config["gateway_ip"]
     macaddr = "AA:57:27:51:75:18"
     bridge  = "vmbr443"
   }]
 }
 
 output "worker2_summary" {
   value = module.worker2.summary
 }
 
 module "webapp" {
   source = "../modules/node"
   config = local.config
 
   vmid        = 119
   hostname    = "webapp"
   description = "Archive/Webapp service node"
   hypervisor  = "branly"
   cores       = 4
   memory      = 16384
   balloon     = 1024
   # to match the real vm configuration in proxmox
   # to remove
   args = "-device virtio-rng-pci"
   networks = [{
     id      = 0
     ip      = "192.168.130.30"
     gateway = local.config["gateway_ip"]
     macaddr = "1A:00:39:95:D4:5F"
     bridge  = "vmbr443"
   }]
 }
 
 output "webapp_summary" {
   value = module.webapp.summary
 }
 
 module "deposit" {
   source = "../modules/node"
   config = local.config
 
   vmid        = 120
   hostname    = "deposit"
   description = "Deposit service node"
   hypervisor  = "beaubourg"
   cores       = "4"
   memory      = "8192"
   balloon     = 1024
   # to match the real vm configuration in proxmox
   # to remove
   args = "-device virtio-rng-pci"
   networks = [{
     id      = 0
     ip      = "192.168.130.31"
     gateway = local.config["gateway_ip"]
     macaddr = "9E:81:DD:58:15:3B"
     bridge  = "vmbr443"
   }]
 }
 
 output "deposit_summary" {
   value = module.deposit.summary
 }
 
 module "vault" {
   source = "../modules/node"
   config = local.config
 
   vmid        = 121
   hostname    = "vault"
   description = "Vault services node"
   hypervisor  = "beaubourg"
   cores       = "4"
   memory      = "8192"
   balloon     = 1024
   # to match the real vm configuration in proxmox
   # to remove
   args = "-device virtio-rng-pci"
   networks = [{
     id      = 0
     ip      = "192.168.130.60"
     gateway = local.config["gateway_ip"]
     macaddr = "16:15:1C:79:CB:DB"
     bridge  = "vmbr443"
   }]
 }
 
 output "vault_summary" {
   value = module.vault.summary
 }
 
 
 module "rp0" {
   source     = "../modules/node"
   config     = local.config
   hypervisor = "branly"
 
   vmid        = 129
   hostname    = "rp0"
   description = "Node to host the reverse proxy"
   cores       = 2
   memory      = 2048
   balloon     = 1024
   networks = [{
     id      = 0
     ip      = "192.168.130.20"
     gateway = local.config["gateway_ip"]
     macaddr = "4A:80:47:5D:DF:73"
     bridge  = "vmbr443"
   }]
   # facter_subnet     = "sesi_rocquencourt_staging"
   # factor_deployment = "staging"
 }
 
 output "rp0_summary" {
   value = module.rp0.summary
 }
 
 
 module "search-esnode0" {
   source     = "../modules/node"
   config     = local.config
   hypervisor = "branly"
 
   vmid        = 130
   hostname    = "search-esnode0"
   description = "Node to host the elasticsearch instance"
   cores       = "4"
   memory      = "32768"
   balloon     = 9216
   networks = [{
     id      = 0
     ip      = "192.168.130.80"
     gateway = local.config["gateway_ip"]
     macaddr = "96:74:49:BD:B5:08"
     bridge  = "vmbr443"
   }]
   storages = [{
     id      = 0
     storage = "proxmox"
     size    = "32G"
     }, {
     id      = 1
     storage = "proxmox"
     size    = "200G"
   }]
 }
 
 output "search-esnode0_summary" {
   value = module.search-esnode0.summary
 }
 
 module "search0" {
   source     = "../modules/node"
   config     = local.config
   hypervisor = "branly"
 
   vmid        = 131
   hostname    = "search0"
   description = "Node to host the swh-search rpc backend service"
   cores       = 2
   memory      = 4096
   balloon     = 1024
   networks = [{
     id      = 0
     ip      = "192.168.130.90"
     gateway = local.config["gateway_ip"]
     macaddr = "EE:FA:76:55:CF:99"
     bridge  = "vmbr443"
   }]
 }
 
 output "search0_summary" {
   value = module.search0.summary
 }
 
 
 
 module "objstorage0" {
   source     = "../modules/node"
   config     = local.config
   hypervisor = "pompidou"
 
   vmid        = 102
   hostname    = "objstorage0"
   description = "Node to host a read-only objstorage for mirrors"
   cores       = 2
   memory      = 12288
   balloon     = 3072
   networks = [{
     id      = 0
     ip      = "192.168.130.110"
     gateway = local.config["gateway_ip"]
     macaddr = "5E:28:EA:7D:50:0D"
     bridge  = "vmbr443"
   }]
 }
 
 output "objstorage0_summary" {
   value = module.objstorage0.summary
 }
 
 module "worker3" {
   source      = "../modules/node"
   config      = local.config
   vmid        = 137
   hostname    = "worker3"
   description = "Indexer worker"
   hypervisor  = "pompidou"
   cores       = 4
   memory      = 24576
   balloon     = 4096
   onboot      = false
 
   networks = [{
     id      = 0
     ip      = "192.168.130.103"
     gateway = local.config["gateway_ip"]
     macaddr = "1A:F8:1A:2C:12:E1"
     bridge  = "vmbr443"
   }]
 }
 
 output "worker3_summary" {
   value = module.worker3.summary
 }
 
 module "counters0" {
   source      = "../modules/node"
   config      = local.config
   vmid        = 138
   hostname    = "counters0"
   description = "Counters server"
   hypervisor  = "pompidou"
   cores       = "4"
   memory      = "6096"
   balloon     = 2048
   networks = [{
     id      = 0
     ip      = "192.168.130.95"
     gateway = local.config["gateway_ip"]
     macaddr = "E2:6E:12:C7:3E:A4"
     bridge  = "vmbr443"
   }]
 }
 
 output "counters0_summary" {
   value = module.counters0.summary
 }
 
 module "mirror-test" {
   source      = "../modules/node"
   config      = local.config
   vmid        = 132
   hostname    = "mirror-test"
   description = "Sandbox VM to test the mirror environment"
   hypervisor  = "uffizi"
   sockets     = "2"
   cores       = "4"
 
   memory  = "65536"
   balloon = "20480"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.160"
     gateway = local.config["gateway_ip"]
     macaddr = "E6:3C:8A:B7:26:5D"
     bridge  = "vmbr443"
   }]
 }
 
 output "mirror-tests_summary" {
   value = module.mirror-test.summary
 }
 
 module "maven-exporter0" {
   source      = "../modules/node"
-  template    = "debian-bullseye-11.3-2022-04-21"
+  template    = var.templates["stable-zfs"]
   vmid        = 122
   config      = local.config
   hostname    = "maven-exporter0"
   description = "Maven index exporter to run containers and expose export.fld files"
   hypervisor  = "pompidou"
   sockets     = "1"
   cores       = "4"
   onboot      = true
 
   memory  = "4096"
   balloon = "1024"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.70"
     gateway = local.config["gateway_ip"]
     macaddr = "36:86:F6:F9:2A:5D"
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "20G"
     }, {
     storage = "proxmox"
     size    = "50G"
     }
   ]
 }
 
 output "maven-exporter0_summary" {
   value = module.maven-exporter0.summary
 }
 
 module "scrubber0" {
   source      = "../modules/node"
   vmid        = 142
   config      = local.config
   hostname    = "scrubber0"
   description = "Scrubber checker services"
   hypervisor  = "pompidou"
   sockets     = "1"
   cores       = "4"
   onboot      = true
 
   memory  = "4096"
   balloon = "1024"
 
   networks = [{
     id      = 0
     ip      = "192.168.130.120"
     gateway = local.config["gateway_ip"]
     macaddr = "86:09:0A:61:AB:C1"
     bridge  = "vmbr443"
   }]
 
   storages = [{
     storage = "proxmox"
     size    = "30G"
     }
   ]
 }
 
 output "scrubber0_summary" {
   value = module.scrubber0.summary
 }
diff --git a/proxmox/terraform/variables.tf b/proxmox/terraform/variables.tf
index 0b5778f..de846d6 100644
--- a/proxmox/terraform/variables.tf
+++ b/proxmox/terraform/variables.tf
@@ -1,49 +1,61 @@
 variable "domain" {
   description = "DNS zone for the staging area"
   type        = string
   default     = "internal.staging.swh.network"
 }
 
 variable "puppet_environment" {
   description = "Puppet environment to use (swh-site's git branch)"
   type        = string
   default     = "staging"
 }
 
 variable "puppet_master" {
   description = "Puppet master FQDN"
   type        = string
   default     = "pergamon.internal.softwareheritage.org"
 }
 
 variable "dns" {
   description = "DNS server ip"
   type        = string
   default     = "192.168.100.29"
 }
 
 variable "gateway_ip" {
   description = "Staging network gateway ip"
   type        = string
   default     = "192.168.130.1"
 }
 
 variable "user_admin" {
   description = "User admin to use for managing the node"
   type        = string
   default     = "root"
 }
 
 # public key part to install through cloud-init so ssh connection is possible
 # `pass search terraform-proxmox` in credential store
 variable "user_admin_ssh_public_key" {
   type    = string
   default = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVKCfpeIMg7GS3Pk03ZAcBWAeDZ+AvWk2k/pPY0z8MJ3YAbqZkRtSK7yaDgJV6Gro7nn/TxdJLo2jEzzWvlC8d8AEzhZPy5Z/qfVVjqBTBM4H5+e+TItAHFfaY5+0WvIahxcfsfaq70MWfpJhszAah3ThJ4mqzYaw+dkr42+a7Gx3Ygpb/m2dpnFnxvXdcuAJYStmHKU5AWGWWM+Fm50/fdMqUfNd8MbKhkJt5ihXQmZWMOt7ls4N8i5NZWnS9YSWow8X/ENOEqCRN9TyRkc+pPS0w9DNi0BCsWvSRJOkyvQ6caEnKWlNoywCmM1AlIQD3k4RUgRWe0vqg/UKPpH3Z root@terraform"
 }
 
 # private key path so the provisioning step can leverage the ssh connection
 # `pass search terraform-proxmox` in credential store and install the key locally
 variable "user_admin_ssh_private_key_path" {
   type    = string
   default = "~/.ssh/id-rsa-terraform-proxmox-root"
 }
+
+# Hashmap of debian release to our associated vm templates
+# This should be maintained up-to-date with most recent built templates
+variable "templates" {
+  description = "Debian image templates created by packer"
+  type = map(string)
+  default = {
+    oldstable  = "debian-buster-10.10-2021-09-09"
+    stable     = "debian-bullseye-11.4-2022-07-27"
+    stable-zfs = "debian-bullseye-11.4-zfs-2022-07-27"
+  }
+}