diff --git a/src/openapi/definitions.yaml b/src/openapi/definitions.yaml
index 6ec307128..7e4ff45b1 100644
--- a/src/openapi/definitions.yaml
+++ b/src/openapi/definitions.yaml
@@ -1,161 +1,229 @@
-alerts:
-  type: object
-  properties:
-    drone:
-      default: slack
-      enum:
-        - slack
-        - msteams
-      type: string
-    email:
-      additionalProperties: false
-      properties:
-        critical:
-          $ref: '#/email'
-          description: One or more email addresses (comma separated) for critical events.
-        nonCritical:
-          $ref: '#/email'
-          description: One or more email addresses (comma separated) for non-critical events.
-      type: object
-    groupInterval:
-      default: 5m
-      description: How long to wait before sending a notification about new alerts that are added to a group of alerts for which an initial notification has already been sent. (Usually ~5m or more.)
-      type: string
-    msteams:
-      additionalProperties: false
-      properties:
-        highPrio:
-          description: The low prio web hook.
-          type: string
-        lowPrio:
-          description: The high prio web hook.
-          type: string
-      type: object
-    receivers:
-      description: Notification receivers.
-      items:
-        enum:
-          - slack
-          - msteams
-          - email
-        type: string
-      type: array
-    repeatInterval:
-      default: 3h
-      description: How long to wait before sending a notification again if it has already been sent successfully for an alert. (Usually ~3h or more).
-      type: string
-    slack:
-      additionalProperties: false
-      properties:
-        channel:
-          default: mon-otomi
-          description: The Slack channel for non-critical notifications.
-          type: string
-        channelCrit:
-          default: mon-otomi
-          description: The Slack channel for critical notifications.
-          type: string
-        url:
-          $ref: '#/url'
-          description: A Slack webhook URL.
-      type: object
+---
 annotation:
-  type: string
   pattern: ^((.){1,253}\/)?(.){1,63}$
+  type: string
 annotations:
   description: Kubernetes annotations with arbitrary metadata
-  type: array
   items:
-    type: object
     properties:
       name:
         $ref: '#/annotation'
       value:
-        type: string
         maxLength: 32767
-awsCreds:
+        type: string
+    type: object
+  type: array
+aws:
   properties:
-    accessKey:
-      type: string
-    secretKey:
-      type: string
+    provider:
+      $ref: '#/provider'
     region:
+      title: Region
       type: string
-  type: object
   required:
-    - accessKey
-    - secretKey
     - region
-azureCreds:
+  title: AWS DNS Settings
+awsCreds:
   properties:
-    clientId:
+    aws:
+      properties:
+        accessKey:
+          type: string
+        region:
+          type: string
+        secretKey:
+          type: string
+      required:
+        - accessKey
+        - secretKey
+        - region
+    provider:
+      $ref: '#/provider'
+  title: AWS Credentials
+azure:
+  description: Enter Azure DNS settings.
+  properties:
+    aadClientId:
+      description: Azure Application Client ID
+      title: Client ID
       type: string
-    clientSecret:
+    aadClientSecret:
+      description: Azure Application Client Secret
+      title: Client secret
+      type: string
+    cloud:
+      description: Azure Cloud
+      title: Cloud
       type: string
-    environment:
+    hostedZoneName:
+      title: Hosted zone name
+      type: string
+    provider:
+      $ref: '#/provider'
+    resourceGroup:
+      description: Azure resource group
+      title: Resource group
+      type: string
+    subscriptionId:
+      description: Azure subscription ID
+      title: Subscription ID
       type: string
     tenantId:
+      description: Azure tenant ID
+      title: Tenant ID
       type: string
-  type: object
+    useManagedIdentityExtension:
+      default: false
+      description: If you use Azure MSI, this should be set to true
+      title: Using managed identities?
+      type: boolean
   required:
-    - clientId
-    - clientSecret
+    - resourceGroup
     - tenantId
+    - subscriptionId
+    - aadClientId
+    - aadClientSecret
+  title: Azure DNS Settings
+  type: object
+azureCreds:
+  description: Enter Azure credentials.
+  properties:
+    azure:
+      properties:
+        clientId:
+          description: Enter client ID.
+          title: Client ID
+          type: string
+        clientSecret:
+          description: Enter client secret.
+          title: Client Secret
+          type: string
+        environment:
+          description: Enter Azure environment.
+          title: Environment
+          type: string
+        tenantId:
+          description: Enter tenant ID.
+          title: Tenant ID
+          type: string
+      required:
+        - clientId
+        - clientSecret
+        - tenantId
+    provider:
+      $ref: '#/provider'
+  required:
+    - azure
+    - provider
+  title: Azure Credentials
 azureMonitor:
-  title: Azure Monitor
   description: Azure Monitor data can be made available in Grafana.
   properties:
+    appInsightsApiKey:
+      description: An Azure AppInsights client secret.
+      title: AppInsights api key
+      type: string
+    appInsightsAppId:
+      description: An Azure AppInsights client id.
+      title: AppInsights app id
+      type: string
+    azureLogAnalyticsSameAs:
+      default: true
+      title: LogAnalytics using same creds?
+      type: boolean
     clientId:
-      title: Azure client id
       description: An Azure client id.
+      title: Azure client id
       type: string
     clientSecret:
-      title: Azure client secret
       description: An Azure client secret.
+      title: Azure client secret
       type: string
-    tenantId:
-      title: LogAnalytics tenant id
-      description: An Azure monitor log analytics workspace.
-      type: string
-    subscriptionId:
-      title: Azure subscription id
-      description: An Azure subscription id.
-      type: string
-    azureLogAnalyticsSameAs:
-      title: LogAnalytics using same creds?
-      type: boolean
-      default: true
     logAnalyticsClientId:
-      title: LogAnalytics client id
       description: An Azure client secret.
+      title: LogAnalytics client id
       type: string
     logAnalyticsClientSecret:
-      title: LogAnalytics client secret
       description: An Azure client secret.
-      type: string
-    logAnalyticsTenantId:
-      title: LogAnalytics tenant id
-      description: An Azure tenant id.
+      title: LogAnalytics client secret
       type: string
     logAnalyticsDefaultWorkspace:
-      title: LogAnalytics workspace
       description: An Azure LogAnalytics workspace.
+      title: LogAnalytics workspace
       type: string
-    appInsightsApiKey:
-      title: AppInsights api key
-      description: An Azure AppInsights client secret.
+    logAnalyticsTenantId:
+      description: An Azure tenant id.
+      title: LogAnalytics tenant id
       type: string
-    appInsightsAppId:
-      title: AppInsights app id
-      description: An Azure AppInsights client id.
+    subscriptionId:
+      description: An Azure subscription id.
+      title: Azure subscription id
+      type: string
+    tenantId:
+      description: An Azure monitor log analytics workspace.
+      title: LogAnalytics tenant id
       type: string
   required:
     - clientId
     - clientSecret
+  title: Azure Monitor
   type: object
+cluster:
+  properties:
+    apiName:
+      description: Only used for API/UI to show in app.
+      type: string
+      readOnly: true
+    apiServer:
+      description: Used by kubectl for local deployment to target cluster.
+      type: string
+      readOnly: true
+    domainSuffix:
+      $ref: 'definitions.yaml#/domain'
+      description: Domain suffix for the cluster. Also added to list of dns zones in the Otomi Console.
+    entrypoint:
+      description: A Kubernetes API public IP address (onprem only).
+      type: string
+      readOnly: true
+    k8sVersion:
+      $ref: 'definitions.yaml#/k8sVersion'
+      readOnly: true
+    name:
+      type: string
+      readOnly: true
+    otomiVersion:
+      default: latest
+      description: 'Please pin this a valid release version found in the repo. Suggestion: try the most recent stable version.'
+      type: string
+    provider:
+      type: string
+      enum:
+        - aws
+        - azure
+        - google
+        - onprem
+      readOnly: true
+    region:
+      description: Dependent on provider.
+      type: string
+      readOnly: true
+    vpcID:
+      description: AWS only. If provided will override autodiscovery from metadata.
+      type: string
+      readOnly: true
+  required:
+    - apiServer
+    - domainSuffix
+    - k8sVersion
+    - name
+    - otomiVersion
+    - provider
+    - region
+  type: object
+
 cpuQuantity:
-  description: Amount of cores, or slice of cpu in millis.
   default: 50m
+  description: Amount of cores, or slice of cpu in millis.
   example:
     - '1'
     - 200m
@@ -168,29 +236,61 @@ email:
   pattern: ^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$
   type: string
 env:
-  title: Environment variables
-  # description: Environment variables for containers
-  type: array
-  nullable: true
   items:
     properties:
       name:
-        type: string
         pattern: ^[a-zA-Z0-9_]*$
-      value:
         type: string
+      value:
         maxLength: 131072
+        type: string
     required:
       - name
       - value
     type: object
-googleCreds:
+  nullable: true
+  title: Environment variables
+  type: array
+google:
+  description: Enter Google DNS settings.
   properties:
-    accountJson:
-      type: string
     project:
+      description: Enter a GCP project.
+      title: GCP Project
+      type: string
+    provider:
+      $ref: '#/provider'
+    serviceAccountKey:
+      description: Enter a service account key for managing a DNS zone.
+      title: Service Account Key
       type: string
+  required:
+    - serviceAccountKey
+    - project
+    - provider
+  title: Google DNS Settings
   type: object
+googleCreds:
+  description: Enter Google credentials.
+  properties:
+    google:
+      description: Enter GCP details.
+      properties:
+        accountJson:
+          description: Enter GCP account JSON for authentication.
+          title: Account JSON
+          type: string
+        project:
+          description: Enter GCP project.
+          title: GCP Project
+          type: string
+      title: Google
+    provider:
+      $ref: '#/provider'
+  required:
+    - google
+    - provider
+  title: Google Credentials
 hostPort:
   pattern: ^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]):()([1-9]|[1-5]?[0-9]{2,4}|6[1-4][0-9]{3}|65[1-4][0-9]{2}|655[1-2][0-9]|6553[1-5])$
   type: string
@@ -212,8 +312,8 @@ image:
     tag:
       default: latest
       type: string
-  type: object
   title: Container image
+  type: object
 imageSimple:
   additionalProperties: false
   properties:
@@ -225,8 +325,8 @@ imageSimple:
       type: string
     tag:
       type: string
-  type: object
   title: Container image
+  type: object
 k8sVersion:
   default: '1.19'
   description: The cluster k8s version. Otomi supports 2 minor versions backwards compatibility from the suggested default.
@@ -243,11 +343,11 @@ labelsAnnotations:
   items:
     properties:
       name:
-        type: string
         pattern: ^((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]){1,253}\/)?([a-z0-9A-Z]+[a-z0-9A-Z-_.]+[a-z0-9A-Z]){1,63}$
-      values:
         type: string
+      values:
         pattern: ^((.){1,253}\/)?(.){1,63}$
+        type: string
     type: object
   type: array
 logLevel:
@@ -260,8 +360,8 @@ logLevel:
     - trace
   type: string
 memoryQuantity:
-  description: Amount of memory. Valid units are E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki.
   default: 64Mi
+  description: Amount of memory. Valid units are E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki.
   example:
     - 1Mi
     - 0.5M
@@ -284,10 +384,14 @@ podSecurityContext:
       type: integer
   type: object
 portNumber:
+  default: 80
   maximum: 32768
   minimum: 80
-  default: 80
   type: number
+provider:
+  description: This property is reserved for the Discriminator object in validation.
+  title: Provider Discriminator Property
+  type: string
 rawValues:
   description: "May define value overrides for a chart. WARNING: these values currently have no schema and can't be validated as such, and may break deployment. You are on your own here."
   type: object
@@ -405,6 +509,10 @@ secrets:
   title: Secrets
   type: array
   uniqueItems: true
+settingsType:
+  description: This property is reserved for the Discriminator object in validation.
+  title: Settings Type
+  type: string
 subdomainType:
   pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
   type: string
@@ -412,12 +520,20 @@ url:
   pattern: ^(https:\/\/)([\w\-])+\.{1}([a-zA-Z]{2,63})([\/\w-]*)*\/?\??([^#\n\r]*)?#?([^\n\r]*)$
   type: string
 vaultCreds:
+  description: Enter Hashicorp's Vault credentials.
   properties:
-    token:
-      type: string
-  type: object
+    provider:
+      $ref: '#/provider'
+    vault:
+      properties:
+        token:
+          type: string
+      required:
+        - token
   required:
-    - token
+    - provider
+    - vault
+  title: Vault Credentials
 volumes:
   items:
     additionalProperties: false
diff --git a/src/openapi/settings.yaml b/src/openapi/settings.yaml
index 4434db203..28249e36d 100644
--- a/src/openapi/settings.yaml
+++ b/src/openapi/settings.yaml
@@ -25,29 +25,6 @@ alerts: &alerts
       default: 5m
       description: How long to wait before sending a notification about new alerts that are added to a group of alerts for which an initial notification has already been sent. (Usually ~5m or more.)
       type: string
-kms:
-  additionalProperties: false
-  properties:
-    sops:
-      oneOf:
-        - aws:
-            $ref: definitions.yaml#/awsCreds
-          required:
-            - aws
-        - azure:
-            $ref: definitions.yaml#/azureCreds
-          required:
-            - azure
-        - google:
-            $ref: definitions.yaml#/googleCreds
-          required:
-            - google
-        - vault:
-            $ref: definitions.yaml#/vaultCreds
-          required:
-            - vault
-      type: object
-  type: object
 msteams:
   additionalProperties: false
   properties: