diff --git a/charts/incubator/multus-cni/.helmignore b/charts/incubator/multus-cni/.helmignore
new file mode 100644
index 00000000000..feb7464da6f
--- /dev/null
+++ b/charts/incubator/multus-cni/.helmignore
@@ -0,0 +1,32 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# OWNERS file for Kubernetes
+OWNERS
+# helm-docs templates
+*.gotmpl
+# docs folder
+/docs
+# icon
+icon.png
+icon.webp
+icon-small.webp
diff --git a/charts/incubator/multus-cni/Chart.yaml b/charts/incubator/multus-cni/Chart.yaml
new file mode 100644
index 00000000000..edcfa5dfb79
--- /dev/null
+++ b/charts/incubator/multus-cni/Chart.yaml
@@ -0,0 +1,42 @@
+annotations:
+  artifacthub.io/links: |-
+    - name: support
+    url: https://discord.com/invite/tVsPTHWTtr
+  max_scale_version: 24.04.1
+  min_scale_version: 24.04.0
+  truecharts.org/SCALE-support: "false"
+  truecharts.org/category: network
+  truecharts.org/max_helm_version: "3.17"
+  truecharts.org/max_kubernetes_version: 1.32.0
+  truecharts.org/min_helm_version: "3.14"
+  truecharts.org/min_kubernetes_version: 1.24.0
+  truecharts.org/train: incubator
+apiVersion: v2
+appVersion: 4.2.3
+dependencies:
+  - name: common
+    version: 28.26.3
+    repository: oci://oci.trueforge.org/truecharts
+    condition: ""
+    alias: ""
+    tags: []
+    import-values: []
+deprecated: false
+description: |
+  A CNI meta-plugin for multi-homed pods in Kubernetes
+home: https://truecharts.org/charts/incubator/multus-cni
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/multus-cni.webp
+keywords:
+  - cni
+  - networking
+kubeVersion: '>=1.24.0-0'
+maintainers:
+  - name: TrueCharts
+    email: info@truecharts.org
+    url: https://truecharts.org
+name: multus-cni
+sources:
+  - https://github.com/k8snetworkplumbingwg/multus-cni
+  - https://github.com/trueforge-org/truecharts/tree/master/charts/incubator/multus-cni
+type: application
+version: 0.1.0
diff --git a/charts/incubator/multus-cni/README.md b/charts/incubator/multus-cni/README.md
new file mode 100644
index 00000000000..2b8cc49d247
--- /dev/null
+++ b/charts/incubator/multus-cni/README.md
@@ -0,0 +1,3 @@
+---
+title: README
+---
diff --git a/charts/incubator/multus-cni/ci/basic-values.yaml b/charts/incubator/multus-cni/ci/basic-values.yaml
new file mode 100644
index 00000000000..15fb34df72a
--- /dev/null
+++ b/charts/incubator/multus-cni/ci/basic-values.yaml
@@ -0,0 +1,43 @@
+workload:
+  main:
+    # This is a workaround for CI and should be removed once
+    # https://github.com/trueforge-org/truecharts/issues/43512
+    # is fixed
+    type: Deployment
+
+configmap:
+  dummy:
+    enabled: true
+    data:
+      123-dummy.conf: |
+        {
+          "cniVersion": "0.3.1",
+          "name": "my-dummy-network",
+          "type": "dummy",
+          "ipam": {
+            "type": "host-local",
+            "ranges": [
+              [
+                {
+                  "subnet": "10.10.0.0/24",
+                  "gateway": "10.10.0.1"
+                }
+              ]
+            ],
+            "routes": [
+              { "dst": "0.0.0.0/0" }
+            ]
+          }
+        }
+
+persistence:
+  dummy:
+    enabled: true
+    type: configmap
+    # NOTE:
+    # Must match the mount path specified in the `multus-cni` chart
+    # under `persistence.cniconf.mountPath`
+    mountPath: "/host/etc/cni/net.d/123-dummy.conf"
+    objectName: dummy
+    subPath: 123-dummy.conf
+    readOnly: true
diff --git a/charts/incubator/multus-cni/docs/multus.md b/charts/incubator/multus-cni/docs/multus.md
new file mode 100644
index 00000000000..d9f776091c9
--- /dev/null
+++ b/charts/incubator/multus-cni/docs/multus.md
@@ -0,0 +1,275 @@
+---
+title: Multus
+---
+
+It is strongly recommended to check out the Multus [project documentation](https://github.com/k8snetworkplumbingwg/multus-cni/tree/master/docs) before
+you start configuring this chart.
+
+## Integrations
+
+### Cilium
+
+Cilium is an exclusive CNI by default and needs to be configured to allow interoperation with other CNIs.
+
+To do this, the following value needs to be added to the Cilium chart:
+
+```yaml
+cni:
+  exclusive: false
+```
+
+### Talos
+
+Talos does not ship all reference CNI plugins by default. You can check which
+CNI plugins are available in your talos install using the following command:
+
+```bash
+$ talosctl list /opt/cni/bin
+NODE        NAME
+192.168.1.10   .
+192.168.1.10   bridge
+192.168.1.10   cilium-cni
+192.168.1.10   firewall
+192.168.1.10   flannel
+192.168.1.10   host-local
+192.168.1.10   ipvlan
+192.168.1.10   loopback
+192.168.1.10   macvlan
+192.168.1.10   multus-shim
+192.168.1.10   passthru
+192.168.1.10   portmap
+```
+
+If you find that the plugins you require are missing, you can use this chart to
+install them. To do so, you must enable the Talos integration and specify
+which CNI binaries you would like to have installed. For example:
+
+```yaml
+multus:
+  integrations:
+    talos:
+      enabled: true
+      installCni:
+        macvlan: true
+        ipvlan: true
+```
+
+The above configuration will install the `macvlan` and `ipvlan` CNI plugins. This
+is the default behaviour (as long as the talos integration is enabled), however,
+it can be disabled by setting the value of any of corresponding keys to `false`.
+On the other hand, more CNI plugins can be specified for installation by adding
+their names under the `installCni` map in the form of `<binary_name>: true`.
+
+:::danger
+If the Talos integration is enabled, this chart assumes it has full control
+over all CNIs listed in `integrations.talos.installCni`(and set to `true`).
+During [uninstall](#uninstalling), it will remove all CNIs that are enabled
+(`true`). If this is undesired, set the keys of the relevant CNI names to `false`
+before enabling the [uninstall](#uninstalling) chart mode.
+:::
+
+
+## Adding network interfaces to workloads
+
+Adding a network interface to a workload consists of 2 steps:
+
+1. Defining the interface template via `NetworkAttachementDefinition` CRD.
+2. Attaching the interface to a pod via custom annotations
+
+:::tip
+More details can be found in the [Multus documentation](https://github.com/k8snetworkplumbingwg/multus-cni/blob/master/docs/how-to-use.md#create-network-attachment-definition).
+:::
+
+:::warning
+If you have a multi-node cluster, you will need to deploy the [Whereabouts](https://github.com/k8snetworkplumbingwg/whereabouts) plugin for IPAM management. The standard `host-local` IPAM plugin does not support multi-node IP assigment and using it may lead to IP conflicts, leaks and/or exhaustion
+:::
+
+### Examples
+
+#### Bridge network
+
+```yaml
+apiVersion: k8s.cni.cncf.io/v1
+kind: NetworkAttachmentDefinition
+metadata:
+  name: bridge-network-with-gateway
+spec:
+  config: '{
+    "cniVersion": "0.3.1",
+    "name": "mynet",
+    "type": "bridge",
+    "bridge": "br-192-168-10",
+    "isDefaultGateway": true,
+    "ipMasq": true,
+    "ipam": {
+      "type": "host-local",
+      "subnet": "192.168.10.0/24",
+      "rangeStart": "192.168.10.200",
+      "rangeEnd": "192.168.10.216",
+      "gateway": "192.168.10.1"
+    }
+  }'
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox-bridge-pod
+  annotations:
+    k8s.v1.cni.cncf.io/networks: bridge-network-with-gateway
+spec:
+  containers:
+  - name: busybox-container
+    image: busybox:1.36
+    command:
+     - "sh"
+     - "-c"
+     - |
+      ip addr
+      echo
+      ip r
+      echo
+      echo '----- Waiting indefinitely -----'
+      sleep infinity
+```
+
+#### Macvlan default route network
+
+```yaml
+apiVersion: k8s.cni.cncf.io/v1
+kind: NetworkAttachmentDefinition
+metadata:
+  name: macvlan-network
+spec:
+  config: '{
+    "cniVersion": "0.3.1",
+    "name": "mynet",
+    "type": "macvlan",
+    "master": "eth0",
+    "mode": "bridge",
+    "ipam": {
+      "type": "host-local",
+      "subnet": "192.168.1.0/24",
+      "rangeStart": "192.168.1.3",
+      "rangeEnd": "192.168.1.99",
+      "gateway": "192.168.1.1",
+      "routes": [
+        { "dst": "0.0.0.0/0" }
+      ]
+    }
+  }'
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox-macvlan-pod
+  annotations:
+    k8s.v1.cni.cncf.io/networks: |
+      [{
+        "name": "macvlan-network",
+        "mac": "02:aa:bb:cc:dd:ee",
+        "default-route": ["192.168.1.1"]
+      }]
+spec:
+  containers:
+  - name: busybox-container
+    image: busybox:1.36
+    command:
+     - "sh"
+     - "-c"
+     - |
+      ip addr
+      echo
+      ip r
+      echo
+      echo '----- Waiting indefinitely -----'
+      sleep infinity
+```
+
+## Uninstalling
+
+:::note
+Before uninstalling this chart, make sure to remove all workloads which make use
+of network interfaces deployed via Multus. Failing to do so may leave stale
+network interfaces in your cluster.
+:::
+
+This chart makes several changes to the node's root filesystem (via host-path
+mounts). These changes cannot be reversed by simply uninstalling the chart.
+
+To combat this, this chart provides an "uninstall" mode, which takes care of
+cleaning up any host filesystem changes made by this chart.
+
+Therefore, when uninstalling, it is recommended to first configure the chart in
+"uninstall" mode like so:
+
+```yaml
+multus:
+  uninstall: true
+```
+
+Once applied, a cleanup container will run (you can check the logs for progress)
+and when it is done, the chart can be safely uninstalled.
+
+## Troubleshooting
+
+### Missing networks after a node reboot
+
+This is a common issue with Multus and is caused by a race condition, where the
+primary CNI starts before Multus after a node reboot. This causes workloads to
+start scheduling before Multus has started, using only the primary CNI to configure
+the pods networks, resulting in missing network interfaces.
+
+The easiest way to fix this is to change the directory where your primary CNI
+places its config file. For example, with `Cilium` this can be achieved like so:
+
+```yaml
+cni:
+  confPath: /etc/cni/net.d/cilium # Note the cilium subdir
+```
+
+Once done, Multus needs to be pointed to where the primary CNI config is located.
+If using `Cilium`, this will look something like this:
+
+```yaml
+multus:
+  primaryCniConfigFile: "cilium/05-cilium.conflist"
+```
+
+:::note
+Due to Multus configuration limitations only subdirectories of the path specified
+under `persistence.cniconf.mountPath` are supported when configuring `multus.primaryCniConfigFile`
+```
+
+:::warning
+If you do not configure the location of the primary CNI config correctly, your
+cluster will become unschedulable. Already deployed workloads will continue working,
+however, new workloads will not be able to be scheduled.
+:::
+
+:::tip
+If you already had your primary CNI deployed using the standard CNI directory,
+a stale config file may be left behind when you change the primary CNI config
+location.
+
+You can try to prevent this from happening by first scaling down primary CNI to
+0 replicas, and checking its config file has been removed from the host file
+system.
+
+If a stale file is left after changing the config file location, you must manually
+remove it from the filesystem of **all** nodes. Otherwise, after a node reboot the cluster will see the stale primary CNI file and immediately try to use it instead of waiting for Multus to start.
+
+An easy way to access a node's filesystem is using the `kubectl debug` command like
+so:
+
+```bash
+kubectl debug node/<NODE_NAME> --profile=sysadmin exec -it --image ubuntu -n kube-system -- sh
+```
+
+Once inside the pod, the host's filesystem will be mounted under `/host`.
+
+When done clean up the completed node debug pod(s) using the following command:
+
+```bash
+kubectl get pods -n kube-system -o name | grep "node-debugger" | xargs kubectl delete -n kube-system
+```
+:::
diff --git a/charts/incubator/multus-cni/icon.webp b/charts/incubator/multus-cni/icon.webp
new file mode 100644
index 00000000000..952e40dc162
Binary files /dev/null and b/charts/incubator/multus-cni/icon.webp differ
diff --git a/charts/incubator/multus-cni/templates/NOTES.txt b/charts/incubator/multus-cni/templates/NOTES.txt
new file mode 100644
index 00000000000..efcb74cb772
--- /dev/null
+++ b/charts/incubator/multus-cni/templates/NOTES.txt
@@ -0,0 +1 @@
+{{- include "tc.v1.common.lib.chart.notes" $ -}}
diff --git a/charts/incubator/multus-cni/templates/common.yaml b/charts/incubator/multus-cni/templates/common.yaml
new file mode 100644
index 00000000000..995efb03eb0
--- /dev/null
+++ b/charts/incubator/multus-cni/templates/common.yaml
@@ -0,0 +1,5 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.v1.common.loader.init" . }}
+
+{{/* Render the templates */}}
+{{ include "tc.v1.common.loader.apply" . }}
diff --git a/charts/incubator/multus-cni/templates/crds/NetworkAttachmentDefinition.yaml b/charts/incubator/multus-cni/templates/crds/NetworkAttachmentDefinition.yaml
new file mode 100644
index 00000000000..8319ebae90e
--- /dev/null
+++ b/charts/incubator/multus-cni/templates/crds/NetworkAttachmentDefinition.yaml
@@ -0,0 +1,44 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: network-attachment-definitions.k8s.cni.cncf.io
+spec:
+  group: k8s.cni.cncf.io
+  scope: Namespaced
+  names:
+    plural: network-attachment-definitions
+    singular: network-attachment-definition
+    kind: NetworkAttachmentDefinition
+    shortNames:
+      - net-attach-def
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          description: 'NetworkAttachmentDefinition is a CRD schema specified by the Network Plumbing
+            Working Group to express the intent for attaching pods to one or more logical or physical
+            networks. More information available at: https://github.com/k8snetworkplumbingwg/multi-net-spec'
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this represen
+                tation of an object. Servers should convert recognized schemas to the
+                latest internal value, and may reject unrecognized values. More info:
+                https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+                object represents. Servers may infer this from the endpoint the client
+                submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: 'NetworkAttachmentDefinition spec defines the desired state of a network attachment'
+              type: object
+              properties:
+                config:
+                  description: 'NetworkAttachmentDefinition config is a JSON-formatted CNI configuration'
+                  type: string
diff --git a/charts/incubator/multus-cni/values.yaml b/charts/incubator/multus-cni/values.yaml
new file mode 100644
index 00000000000..de015a5b301
--- /dev/null
+++ b/charts/incubator/multus-cni/values.yaml
@@ -0,0 +1,520 @@
+image:
+  pullPolicy: IfNotPresent
+  repository: ghcr.io/k8snetworkplumbingwg/multus-cni
+  tag: v4.2.3-thick
+
+craneImage:
+  pullPolicy: IfNotPresent
+  repository: docker.io/alpine/crane
+  tag: 0.20.7
+
+talosCniImage:
+  pullPolicy: IfNotPresent
+  repository: ghcr.io/siderolabs/cni
+  tag: v1.11.0
+
+multus:
+  # Primary CNI value can be:
+  # - "", in which case the aphabetically first file in the CNI JSON
+  #   configuration directory (pointed to by `persistence.cniconf.mountPath`)
+  #   will be used
+  # - The relative path to a CNI config file inside the CNI JSON configuration
+  #   directory (pointed to by `persistence.cniconf.mountPath`). For example
+  #   `05-cilium.conflist`
+  primaryCniConfigFile: ""
+  # Set to true to make Multus wait for the primary CNI to be ready before
+  # it starts attaching extra networks to pods. This can help with pods
+  # crash-looping when primary CNI is not ready
+  readinessIndicatorEnabled: false
+  logLevel: verbose  # "debug", "error", "verbose", or "panic"
+  # Whether to isolate `NetworkAttachmentDefinition`s by namespace.
+  # Setting this to `true` will prevent sharing NAD resources across namespaces
+  namespaceIsolation: false
+  # A list of namespaces for which the `namespaceIsolation` (when set to `true`)
+  # does not apply. `NetworkAttachmentDefinition`s defined in these namespaces
+  # can be used across all namespaces. Note Multus treats the `default` namespace
+  # as global by default (when `globalNamespaces` is empty)
+  globalNamespaces: []
+  # A list of additional networks to attach to every pod
+  # The items of this list can be the names of `NetworkAttachmentDefinition`s,
+  # names of CNI configuration files, paths to CNI configuation files and more.
+  # See Multus documentation for more information
+  defaultNetworks: []
+  # A list namespaces, which are excluded from attaching networks from the
+  # `defaultNetworks` list. By default, this chart's namespace is excluded.
+  systemNamespaces: []
+  # A map of capabilities, that are supported by at least one of the used CNI
+  # plugins. See Multus documentation for more information
+  capabilities: {}
+  # You should not need to change the Multus CNI config version, however,
+  # if you get an error about version incompatibility with the primary CNI it
+  # might help to match the multus CNI version to your primary CNI version
+  cniVersion: 0.3.1
+  integrations:
+    talos:
+      enabled: false  # Must be enabled when installing on a Talos cluster
+      # Select extra reference CNIs to be installed
+      # Note:
+      # - If you are installing any of the reference CNIs, it is strongly
+      #   recommended to override the `talosCniImage.tag` to match your
+      #   Talos version
+      # - To install CNIs that are present in the `talosCniImage` but not listed
+      #   below, simply add them below in the form of `<binary_name>: true`
+      installCni:
+        macvlan: true
+        ipvlan: true
+  # Enable the chart's uninstall mode. This will clean up leftover chart
+  # configuration data and CNI plugins, allowing for a cleaner uninstall.
+  #
+  # Note:
+  # If the Talos integration is enabled, this chart assumes it has full control
+  # over all CNIs listed in `integrations.talos.installCni`(and set to `true`).
+  # During uninstall, it will remove all CNIs that are enabled (`true`). If this
+  # is undesired, set the keys of the relevant CNI names to `false` before
+  # enabling the uninstall mode.
+  uninstall: false
+
+podOptions:
+  hostNetwork: true
+  hostPID: true
+  automountServiceAccountToken: true
+  priorityClassName: system-node-critical
+  # Add a toleration to always allow scheduling
+  # This is used to allow scheduling while there is no working primary CNI (yet),
+  # as in such cases the node is usually tainted with "NoSchedule" since it is
+  # not ready for regular workloads. However, depending on config, it may be
+  # desired (or even enforced) for Multus to start first, to ensure that all
+  # pod interface configuration passes through it after a node reboot.
+  tolerations:
+    - operator: Exists
+
+configmap:
+  config:
+    enabled: true
+    data:
+      daemon-config.json: |
+        {
+            "cniVersion": "{{ .Values.multus.cniVersion }}",
+            "confDir": "{{ tpl .Values.persistence.cniconf.mountPath $ }}/multus.d",
+            "cniDir": "{{ tpl .Values.persistence.cnimultusdata.mountPath $ }}",
+            "binDir": "{{ tpl .Values.persistence.cnibin.mountPath $ }}",
+            "logToStderr": true,
+            "logLevel": "{{ .Values.multus.logLevel }}",
+            "namespaceIsolation": {{ .Values.multus.namespaceIsolation }},
+            "globalNamespaces": "{{ join "," .Values.multus.globalNamespaces }}",
+            {{- if .Values.multus.systemNamespaces }}
+            "systemNamespaces": {{ .Values.multus.systemNamespaces | toJson }},
+            {{- else }}
+            "systemNamespaces": ["{{ .Release.Namespace }}"],
+            {{- end }}
+            "defaultNetworks": {{ .Values.multus.defaultNetworks | toJson }},
+            "capabilities": {{ .Values.multus.capabilities | toJson }},
+            "multusMasterCNI": "{{ .Values.multus.primaryCniConfigFile }}",
+            "multusNamespace": "{{ .Release.Namespace }}",
+            {{- if .Values.multus.readinessIndicatorEnabled }}
+              {{- if not .Values.multus.primaryCniConfigFile -}}
+                {{- fail "Invalid configuration: When [multus.readinessIndicatorEnabled] is set to [true], [multus.primaryCniConfigFile] must be set to a non-empty value." -}}
+              {{- end }}
+            "readinessindicatorfile": "{{ tpl .Values.persistence.cniconf.mountPath $ }}/{{ .Values.multus.primaryCniConfigFile }}",
+            {{- end }}
+            {{- if .Values.metrics.main.enabled }}
+            "metricsPort": {{ .Values.service.main.ports.main.port }},
+            {{- end }}
+            "chrootDir": "{{ tpl .Values.persistence.hostroot.mountPath $ }}",
+            "socketDir": "{{ tpl .Values.persistence.hostrun.mountPath $ }}/multus/",
+            "cniConfigDir": "{{ tpl .Values.persistence.cniconf.mountPath $ }}",
+            "multusAutoconfigDir": "{{ tpl .Values.persistence.cniconf.mountPath $ }}",
+            "multusConfigFile": "auto",
+            "retryDeleteOnError": true
+        }
+
+persistence:
+  cnibin:
+    enabled: true
+    type: hostPath
+    # NOTE:
+    # multus-daemon expects that cnibin path to be identical between pod and host
+    mountPath: "{{ tpl .Values.persistence.cnibin.hostPath $ }}"
+    hostPath: /opt/cni/bin
+    hostPathType: DirectoryOrCreate
+    mountPropagation: Bidirectional
+    targetSelector:
+      main:
+        cleanup: {}
+        multus-plugin-installer: {}
+        talos-plugin-installer: {}
+        main: {}
+        dhcp-daemon: {}
+  cniconf:
+    enabled: true
+    type: hostPath
+    mountPath: /host/etc/cni/net.d
+    hostPath: /etc/cni/net.d
+    hostPathType: DirectoryOrCreate
+    targetSelector:
+      main:
+        cleanup: {}
+        main: {}
+  cnimultusdata:  # Used for multus cache data
+    enabled: true
+    type: hostPath
+    mountPath: /var/lib/cni/multus
+    hostPath: /var/lib/cni/multus
+    hostPathType: DirectoryOrCreate
+  # Used for cleanup on during chart uninstall
+  cnimultusdatacleanup:
+    enabled: true
+    type: hostPath
+    # NOTE:
+    # `mountPath` and `hostPath` MUST exactly match `cnimultusdata`'s mount and
+    # host path parent directories.
+    mountPath: "{{ (tpl .Values.persistence.cnimultusdata.mountPath $) | clean | dir }}"
+    hostPath: "{{ (tpl .Values.persistence.cnimultusdata.hostPath $) | clean | dir }}"
+    hostPathType: DirectoryOrCreate
+    targetSelector:
+      main:
+        cleanup: {}
+  daemonconfig:
+    enabled: true
+    type: configmap
+    mountPath: "{{ tpl .Values.persistence.cniconf.mountPath $ }}/multus.d/daemon-config.json"
+    objectName: config
+    subPath: daemon-config.json
+    readOnly: true
+  hostroot:
+    enabled: true
+    type: hostPath
+    mountPath: /hostroot
+    hostPath: /
+    hostPathType: Directory
+    mountPropagation: HostToContainer
+  hostrun:
+    enabled: true
+    type: hostPath
+    mountPath: /host/run
+    hostPath: /run
+    hostPathType: Directory
+    targetSelector:
+      main:
+        cleanup: {}
+        main: {}
+        dhcp-daemon: {}
+  hostrunnetns:
+    enabled: true
+    type: hostPath
+    # NOTE:
+    # The Talos/Multus docs state that this the host's `(/var)/run/netns` must
+    # be mounted under `/run/netns` in the container.
+    #
+    # However, TC common library forcefully renders an emptyDir mount under
+    # `/var/run` to facilitate common uses cases. This is done AFTER any
+    # chart-specific mounts are rendered and since `/var/run` is usually a
+    # symlink to `/run`, this host path mount gets overridden by the
+    # emptyDir mount
+    #
+    # To workaround this we instead mount to `/var/run/netns` inside the
+    # the container, and since `/var/run` is a symlink to `/run`, the mount
+    # also shows under `/run/netns`.
+    mountPath: /var/run/netns
+    hostPath: "{{- if .Values.multus.integrations.talos.enabled -}}/var{{- end -}}/run/netns"
+    hostPathType: DirectoryOrCreate
+    mountPropagation: HostToContainer
+    targetSelector:
+      main:
+        main: {}
+        dhcp-daemon: {}
+  hostrunk8scnicncfio:
+    enabled: true
+    type: hostPath
+    mountPath: /run/k8s.cni.cncf.io
+    hostPath: /run/k8s.cni.cncf.io
+    hostPathType: DirectoryOrCreate
+  hostvarlibkubelet:
+    enabled: true
+    type: hostPath
+    mountPath: /var/lib/kubelet
+    hostPath: /var/lib/kubelet
+    hostPathType: Directory
+    mountPropagation: HostToContainer
+
+workload:
+  main:
+    type: DaemonSet
+    podSpec:
+      initContainers:
+        talos-plugin-installer:
+          enabled: "{{- $cnisMustBeInstalled := false -}}
+            {{- range $key, $value := .Values.multus.integrations.talos.installCni -}}
+              {{- if $value -}}
+                {{- $cnisMustBeInstalled = true -}}
+              {{- end -}}
+            {{- end -}}
+
+            {{ and (not .Values.multus.uninstall)
+              .Values.multus.integrations.talos.enabled
+              $cnisMustBeInstalled }}"
+          type: init
+          imageSelector: craneImage
+          command:
+            - sh
+            - -c
+            - |
+              set -euo pipefail
+              cd /tmp
+
+              echo "Pulling '{{ .Values.talosCniImage.repository }}:{{ .Values.talosCniImage.tag }}' image..."
+              crane export {{ .Values.talosCniImage.repository }}:{{ .Values.talosCniImage.tag }} cni.tar
+
+              echo "Extracting CNI binaries..."
+              mkdir -p cniBins
+              tar -xvf cni.tar --strip-components=3 -C cniBins opt/cni/bin >/dev/null
+              ls cniBins # print available binaries for ease of debugging
+              echo
+
+              {{- $cniBinMountPath := (tpl .Values.persistence.cnibin.mountPath $) -}}
+              {{- range $key, $value := .Values.multus.integrations.talos.installCni -}}
+                {{- if $value }}
+              echo "Copying {{ $key }} to '{{ $cniBinMountPath }}/{{ $key }}'"
+              cp cniBins/{{ $key }} "{{ $cniBinMountPath }}/{{ $key }}"
+                {{- end }}
+              {{- end -}}
+          securityContext:
+            privileged: true
+            runAsUser: 0
+            runAsGroup: 0
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: "10m"
+              memory: "15Mi"
+        multus-plugin-installer:
+          enabled: "{{ not .Values.multus.uninstall }}"
+          type: init
+          imageSelector: image
+          command:
+            - "/usr/src/multus-cni/bin/install_multus"
+          args:
+            - "-d"
+            - "{{ tpl .Values.persistence.cnibin.mountPath $ }}"
+            - "-t"
+            - "thick"
+          securityContext:
+            privileged: true
+            runAsUser: 0
+            runAsGroup: 0
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: "10m"
+              memory: "15Mi"
+          termination:
+            messagePolicy: FallbackToLogsOnError
+      containers:
+        cleanup:
+          enabled: "{{ .Values.multus.uninstall }}"
+          type: init
+          imageSelector: alpineImage
+          command:
+            - sh
+            - -c
+            - |
+              echoRun() {
+                echo "$@"
+                eval "$@"
+              }
+
+              set -euo pipefail
+
+              echo "Cleaning up Multus CNI config..."
+              echoRun rm -rf "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/*multus.*
+              echo
+
+              echo "Cleaning up Multus CNI data..."
+              echoRun rm -rf "{{ tpl .Values.persistence.cnimultusdata.mountPath $ }}"
+              echo
+
+              echo "Cleaning up Multus CNI plugins..."
+              echoRun rm -f "{{ tpl .Values.persistence.cnibin.mountPath $ }}"/multus*
+              echoRun rm -f "{{ tpl .Values.persistence.cnibin.mountPath $ }}"/passthru
+
+              {{- if .Values.multus.integrations.talos.enabled }}
+                {{- $cniBinMountPath := (tpl .Values.persistence.cnibin.mountPath $) -}}
+                {{- $hostRunMountPath := (tpl .Values.persistence.hostrun.mountPath $) -}}
+                {{- range $key, $value := .Values.multus.integrations.talos.installCni -}}
+                  {{- if $value }}
+              echoRun rm -f "{{ $cniBinMountPath }}/{{ $key }}"
+                    {{- if eq $key "dhcp" }}
+              echoRun rm -f "{{ $hostRunMountPath }}/cni/dhcp.sock"
+                    {{- end }}
+                  {{- end }}
+                {{- end -}}
+              {{- end }}
+
+              echo "Cleanup completed! You can now safely uninstall this chart."
+              sleep infinity
+          securityContext:
+            privileged: true
+            runAsUser: 0
+            runAsGroup: 0
+            capabilities:
+              drop:
+                - ALL
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+            startup:
+              enabled: false
+        main:
+          enabled: "{{ not .Values.multus.uninstall }}"
+          env:
+            MULTUS_NODE_NAME:
+              fieldRef:
+                fieldPath: spec.nodeName
+          args:
+            - --config
+            - "{{ tpl .Values.persistence.daemonconfig.mountPath $ }}"
+          securityContext:
+            privileged: true
+            runAsUser: 0
+            runAsGroup: 0
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "50Mi"
+            limits:
+              cpu: "200m"
+              memory: "500Mi"
+          termination:
+            messagePolicy: FallbackToLogsOnError
+          probes:
+            liveness:
+              enabled: true
+              type: exec
+              command:
+                - sh
+                - -c
+                - cat "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/00-multus.conf*
+            readiness:
+              enabled: true
+              type: exec
+              command:
+                - sh
+                - -c
+                - cat "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/00-multus.conf*
+            startup:
+              enabled: true
+              type: exec
+              command:
+                - sh
+                - -c
+                - cat "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/00-multus.conf*
+        dhcp-daemon:
+          enabled: "{{ and (not .Values.multus.uninstall)
+            .Values.multus.integrations.talos.enabled
+            (.Values.multus.integrations.talos.installCni | dig \"dhcp\" false) }}"
+          imageSelector: alpineImage
+          command:
+            - sh
+            - -c
+            - |
+              set -euo pipefail
+
+              SOCKET_PATH="{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
+              CNI_BIN_DIR="{{ (tpl .Values.persistence.cnibin.mountPath $) }}"
+
+              # Make sure the unix socket has been removed
+              rm -f "$SOCKET_PATH"
+
+              # Start the daemon
+              "$CNI_BIN_DIR/dhcp" daemon -socketpath "$SOCKET_PATH" &
+              DAEMON_PID=$!
+
+              if kill -0 $DAEMON_PID 2>/dev/null; then
+                  echo "DHCP daemon started successfully"
+              else
+                  echo "DHCP daemon failed to start..."
+                  exit 1
+              fi
+
+              wait $DAEMON_PID
+          securityContext:
+            privileged: true
+            runAsUser: 0
+            runAsGroup: 0
+          resources:
+            requests:
+              cpu: "10m"
+              memory: "50Mi"
+            limits:
+              cpu: "100m"
+              memory: "100Mi"
+          termination:
+            messagePolicy: FallbackToLogsOnError
+          probes:
+            liveness:
+              enabled: true
+              type: exec
+              command:
+                - sh
+                - -c
+                - test -S "{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
+            readiness:
+              enabled: true
+              type: exec
+              command:
+                - sh
+                - -c
+                - test -S "{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
+            startup:
+              enabled: true
+              type: exec
+              command:
+                - sh
+                - -c
+                - test -S "{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
+
+metrics:
+  main:
+    enabled: true
+    type: servicemonitor
+    endpoints:
+      - port: main
+        path: /metrics
+    targetSelector: main
+
+service:
+  main:
+    enabled: "{{ .Values.metrics.main.enabled }}"
+    clusterIP: None  # No need for ClusterIP with host networking
+    ports:
+      main:
+        enabled: true
+        port: 8080
+        protocol: http
+
+serviceAccount:
+  main:
+    enabled: true
+    primary: true
+rbac:
+  main:
+    enabled: true
+    primary: true
+    clusterWide: true
+    serviceAccounts: ["main"]
+    rules:
+      - apiGroups: ["k8s.cni.cncf.io"]
+        resources: ['*']
+        verbs: ['*']
+      - apiGroups: [""]
+        resources: ["pods", "pods/status"]
+        verbs: ["get", "list", "update", "watch"]
+      - apiGroups: ["", "events.k8s.io"]
+        resources: ["events"]
+        verbs: ["create", "patch", "update"]