diff --git a/bin/k8s/templates/base/_helpers.tpl b/bin/k8s/templates/base/_helpers.tpl
index 8f310823851..f7e724ff8a0 100644
--- a/bin/k8s/templates/base/_helpers.tpl
+++ b/bin/k8s/templates/base/_helpers.tpl
@@ -103,6 +103,83 @@ append the uid to it, so a bare value would render "http://<origin>jupyter/7". *
 {{- printf "/%s" (trimAll "/" .Values.jupyterPool.basePath) -}}
 {{- end -}}
 
+{{/* Start a release-scoped Deployment; the caller supplies the pod spec. */}}
+{{- define "texera.deploymentHeader" -}}
+{{- $app := printf "%s-" .release.Name -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $app }}{{ .name }}
+  namespace: {{ .release.Namespace }}
+  labels:
+    app: {{ $app }}{{ .name }}
+spec:
+  replicas: {{ .replicas }}
+  {{- if .recreate }}
+  # Single writer bound to one RWO volume; never run two at once.
+  strategy:
+    type: Recreate
+  {{- end }}
+  selector:
+    matchLabels:
+      app: {{ $app }}{{ .name }}
+  template:
+    metadata:
+      labels:
+        app: {{ $app }}{{ .name }}
+{{- end -}}
+
+{{- define "texera.observability.containerSecurityContext" -}}
+securityContext:
+  {{- if . }}
+  readOnlyRootFilesystem: true
+  {{- end }}
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: ["ALL"]
+{{- end -}}
+
+{{- define "texera.observability.service" -}}
+{{- $app := printf "%s-%s" .release.Name .app -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $app }}
+  namespace: {{ .release.Namespace }}
+  labels:
+    app: {{ $app }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ $app }}
+  ports:
+    {{- range .ports }}
+    - name: {{ .name }}
+      protocol: TCP
+      port: {{ .port }}
+      targetPort: {{ .port }}
+    {{- end }}
+{{- end -}}
+
+{{- define "texera.observability.dataClaim" -}}
+{{- $app := printf "%s-%s" .release.Name .app -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ $app }}-data
+  namespace: {{ .release.Namespace }}
+  labels:
+    app: {{ $app }}
+spec:
+  accessModes: ["ReadWriteOnce"]
+  {{- if .storage.storageClass }}
+  storageClassName: {{ .storage.storageClass }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .storage.storage }}
+{{- end -}}
+
 {{/* Grafana datasource provisioning body. Kept as a helper so the Deployment's
 checksum/config annotation can hash just this content; hashing the template that
 holds the annotation would make it reference itself and recurse. */}}
@@ -181,3 +258,88 @@ compactor:
   retention_enabled: true
   delete_request_store: filesystem
 {{- end -}}
+{{- define "texera.releaseService" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .name }}-svc
+  namespace: {{ .release.Namespace }}
+spec:
+  type: {{ .serviceType }}
+  selector:
+    app: {{ .release.Name }}-{{ .name }}
+  ports:
+    {{- if .portName }}
+    - name: {{ .portName }}
+      protocol: TCP
+    {{- else }}
+    - protocol: TCP
+    {{- end }}
+      port: {{ .port }}
+      targetPort: {{ .port }}
+      {{- if .useNodePort }}
+      # if service type is set to NodePort, include nodePort attribute
+      {{- if eq .serviceType "NodePort" }}
+      nodePort: {{ .nodePort }}
+      {{- end }}
+      {{- end }}
+{{- end -}}
+
+{{- define "texera.localPersistence" -}}
+{{- $hostBasePath := .hostBasePath }}
+{{- $name := .name }}
+{{- $persistence := .persistence }}
+{{- $volumeName := printf "%s-data-pv" $name }}
+{{- $claimName := printf "%s-data-pvc" $name }}
+{{- $storageClass := $persistence.storageClass | default "local-path" }}
+{{- $size := $persistence.size | default .defaultSize }}
+{{- $hostPath := printf "%s/%s/%s" $hostBasePath $.root.Release.Name $name }}
+
+{{/* Only create PV for local-path storage class */}}
+{{- if and (eq $storageClass "local-path") (ne $hostBasePath "") }}
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: {{ $volumeName }}
+  {{- if not $.root.Values.persistence.removeAfterUninstall }}
+  annotations:
+    "helm.sh/resource-policy": keep
+  {{- end }}
+  labels:
+    type: local
+    app: {{ $.root.Release.Name }}
+    component: {{ $name }}
+spec:
+  storageClassName: {{ $storageClass }}
+  capacity:
+    storage: {{ $size }}
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  hostPath:
+    path: {{ $hostPath }}
+---
+{{- end }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ $claimName }}
+  namespace: {{ $.root.Release.Namespace }}
+  {{- if not $.root.Values.persistence.removeAfterUninstall }}
+  annotations:
+    "helm.sh/resource-policy": keep
+  {{- end }}
+  labels:
+    app: {{ $.root.Release.Name }}
+    component: {{ $name }}
+spec:
+  storageClassName: {{ $storageClass }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ $size }}
+  {{- if and (eq $storageClass "local-path") (ne $hostBasePath "") }}
+  volumeName: {{ $volumeName }}
+  {{- end }}
+{{- end }}
diff --git a/bin/k8s/templates/base/access-control-service/access-control-service-service.yaml b/bin/k8s/templates/base/access-control-service/access-control-service-service.yaml
index 4c2137456a5..f04b9a88d28 100644
--- a/bin/k8s/templates/base/access-control-service/access-control-service-service.yaml
+++ b/bin/k8s/templates/base/access-control-service/access-control-service-service.yaml
@@ -15,16 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.accessControlService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.accessControlService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.accessControlService.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.accessControlService.service.port }}
-      targetPort: {{ .Values.accessControlService.service.port }}
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.accessControlService.name "serviceType" .Values.accessControlService.service.type "port" .Values.accessControlService.service.port) }}
diff --git a/bin/k8s/templates/base/agent-service/agent-service-service.yaml b/bin/k8s/templates/base/agent-service/agent-service-service.yaml
index 581716bf80a..204bb2fa75b 100644
--- a/bin/k8s/templates/base/agent-service/agent-service-service.yaml
+++ b/bin/k8s/templates/base/agent-service/agent-service-service.yaml
@@ -16,17 +16,5 @@
 # under the License.
 
 {{- if .Values.agentService.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.agentService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.agentService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.agentService.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.agentService.service.port }}
-      targetPort: {{ .Values.agentService.service.port }}
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.agentService.name "serviceType" .Values.agentService.service.type "port" .Values.agentService.service.port) }}
 {{- end }}
diff --git a/bin/k8s/templates/base/config-service/config-service-service.yaml b/bin/k8s/templates/base/config-service/config-service-service.yaml
index 8ae32f774f5..ab9afa2d20b 100644
--- a/bin/k8s/templates/base/config-service/config-service-service.yaml
+++ b/bin/k8s/templates/base/config-service/config-service-service.yaml
@@ -15,16 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.configService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.configService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.configService.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.configService.service.port }}
-      targetPort: {{ .Values.configService.service.port }} 
\ No newline at end of file
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.configService.name "serviceType" .Values.configService.service.type "port" .Values.configService.service.port) }}
diff --git a/bin/k8s/templates/base/file-service/file-service-service.yaml b/bin/k8s/templates/base/file-service/file-service-service.yaml
index f4eaf6796bf..b0780dd2004 100644
--- a/bin/k8s/templates/base/file-service/file-service-service.yaml
+++ b/bin/k8s/templates/base/file-service/file-service-service.yaml
@@ -15,21 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.fileService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.fileService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.fileService.name }}
-  ports:
-    - name: api-port
-      protocol: TCP
-      port: {{ .Values.fileService.service.port }}
-      targetPort: {{ .Values.fileService.service.port }}
-      # if service type is set to NodePort, include nodePort attribute
-      {{- if eq .Values.fileService.service.type "NodePort" }}
-      nodePort: {{ .Values.fileService.service.nodePort }}
-      {{- end }}
\ No newline at end of file
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.fileService.name "serviceType" .Values.fileService.service.type "port" .Values.fileService.service.port "nodePort" .Values.fileService.service.nodePort "portName" "api-port" "useNodePort" true) }}
diff --git a/bin/k8s/templates/base/litellm/litellm-service.yaml b/bin/k8s/templates/base/litellm/litellm-service.yaml
index 875bdd08f1d..74411ac45e8 100644
--- a/bin/k8s/templates/base/litellm/litellm-service.yaml
+++ b/bin/k8s/templates/base/litellm/litellm-service.yaml
@@ -16,17 +16,5 @@
 # under the License.
 
 {{- if .Values.litellm.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.litellm.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.litellm.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.litellm.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.litellm.service.port }}
-      targetPort: {{ .Values.litellm.service.port }}
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.litellm.name "serviceType" .Values.litellm.service.type "port" .Values.litellm.service.port) }}
 {{- end }}
diff --git a/bin/k8s/templates/base/notebook-migration-service/notebook-migration-service-service.yaml b/bin/k8s/templates/base/notebook-migration-service/notebook-migration-service-service.yaml
index d13a2d47990..e5b1bafe93a 100644
--- a/bin/k8s/templates/base/notebook-migration-service/notebook-migration-service-service.yaml
+++ b/bin/k8s/templates/base/notebook-migration-service/notebook-migration-service-service.yaml
@@ -15,17 +15,5 @@
 # specific language governing permissions and limitations
 # under the License.
 {{- if .Values.notebookMigrationService.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.notebookMigrationService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.notebookMigrationService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.notebookMigrationService.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.notebookMigrationService.service.port }}
-      targetPort: {{ .Values.notebookMigrationService.service.port }}
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.notebookMigrationService.name "serviceType" .Values.notebookMigrationService.service.type "port" .Values.notebookMigrationService.service.port) }}
 {{- end }}
diff --git a/bin/k8s/templates/base/observability/grafana.yaml b/bin/k8s/templates/base/observability/grafana.yaml
index 36b1e05fe3e..cc0c7a8d564 100644
--- a/bin/k8s/templates/base/observability/grafana.yaml
+++ b/bin/k8s/templates/base/observability/grafana.yaml
@@ -37,22 +37,7 @@ data:
   datasources.yaml: |
     {{- include "texera.observability.grafanaDatasources" . | nindent 4 }}
 ---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Release.Name }}-grafana
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-grafana
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: {{ .Release.Name }}-grafana
-  template:
-    metadata:
-      labels:
-        app: {{ .Release.Name }}-grafana
+{{ include "texera.deploymentHeader" (dict "release" .Release "name" "grafana" "replicas" 1) }}
       annotations:
         # Roll the pod when the provisioned datasources change.
         checksum/config: {{ include "texera.observability.grafanaDatasources" . | sha256sum }}
@@ -65,10 +50,7 @@ spec:
         - name: grafana
           image: {{ .Values.observability.grafana.image }}
           imagePullPolicy: {{ .Values.texeraImages.pullPolicy }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
+          {{- include "texera.observability.containerSecurityContext" false | nindent 10 }}
           env:
             # Admin login. Override for any environment reachable beyond
             # an internal port-forward.
@@ -106,20 +88,7 @@ spec:
         - name: data
           emptyDir: {}
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Release.Name }}-grafana
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-grafana
-spec:
-  type: ClusterIP
-  selector:
-    app: {{ .Release.Name }}-grafana
-  ports:
-    - name: http
-      protocol: TCP
-      port: {{ .Values.observability.grafana.port }}
-      targetPort: {{ .Values.observability.grafana.port }}
+{{ include "texera.observability.service" (dict "release" .Release "app" "grafana" "ports" (list
+    (dict "name" "http" "port" .Values.observability.grafana.port)
+)) }}
 {{- end }}
diff --git a/bin/k8s/templates/base/observability/jaeger.yaml b/bin/k8s/templates/base/observability/jaeger.yaml
index 2821a977736..685ea50085d 100644
--- a/bin/k8s/templates/base/observability/jaeger.yaml
+++ b/bin/k8s/templates/base/observability/jaeger.yaml
@@ -23,22 +23,7 @@ under the License.
 # otlpPort). In-memory storage: a restart wipes traces, same as the
 # single-node compose. Swap in a persistent storage backend for
 # multi-node / production use.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Release.Name }}-jaeger
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-jaeger
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: {{ .Release.Name }}-jaeger
-  template:
-    metadata:
-      labels:
-        app: {{ .Release.Name }}-jaeger
+{{ include "texera.deploymentHeader" (dict "release" .Release "name" "jaeger" "replicas" 1) }}
     spec:
       securityContext:
         runAsNonRoot: true
@@ -46,10 +31,7 @@ spec:
         - name: jaeger
           image: {{ .Values.observability.traces.image }}
           imagePullPolicy: {{ .Values.texeraImages.pullPolicy }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
+          {{- include "texera.observability.containerSecurityContext" false | nindent 10 }}
           ports:
             - name: query
               containerPort: {{ .Values.observability.traces.queryPort }}
@@ -58,24 +40,8 @@ spec:
           resources:
             {{- toYaml .Values.observability.traces.resources | nindent 12 }}
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Release.Name }}-jaeger
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-jaeger
-spec:
-  type: ClusterIP
-  selector:
-    app: {{ .Release.Name }}-jaeger
-  ports:
-    - name: query
-      protocol: TCP
-      port: {{ .Values.observability.traces.queryPort }}
-      targetPort: {{ .Values.observability.traces.queryPort }}
-    - name: otlp-grpc
-      protocol: TCP
-      port: {{ .Values.observability.traces.otlpPort }}
-      targetPort: {{ .Values.observability.traces.otlpPort }}
+{{ include "texera.observability.service" (dict "release" .Release "app" "jaeger" "ports" (list
+    (dict "name" "query" "port" .Values.observability.traces.queryPort)
+    (dict "name" "otlp-grpc" "port" .Values.observability.traces.otlpPort)
+)) }}
 {{- end }}
diff --git a/bin/k8s/templates/base/observability/loki.yaml b/bin/k8s/templates/base/observability/loki.yaml
index d26ca944e28..4c0e7eb8238 100644
--- a/bin/k8s/templates/base/observability/loki.yaml
+++ b/bin/k8s/templates/base/observability/loki.yaml
@@ -34,41 +34,9 @@ data:
   config.yaml: |
     {{- include "texera.observability.lokiConfig" . | nindent 4 }}
 ---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: {{ .Release.Name }}-loki-data
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-loki
-spec:
-  accessModes: ["ReadWriteOnce"]
-  {{- if .Values.observability.logs.storageClass }}
-  storageClassName: {{ .Values.observability.logs.storageClass }}
-  {{- end }}
-  resources:
-    requests:
-      storage: {{ .Values.observability.logs.storage }}
+{{ include "texera.observability.dataClaim" (dict "release" .Release "app" "loki" "storage" .Values.observability.logs) }}
 ---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Release.Name }}-loki
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-loki
-spec:
-  replicas: 1
-  # Single writer bound to one RWO volume; never run two at once.
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: {{ .Release.Name }}-loki
-  template:
-    metadata:
-      labels:
-        app: {{ .Release.Name }}-loki
+{{ include "texera.deploymentHeader" (dict "release" .Release "name" "loki" "replicas" 1 "recreate" true) }}
       annotations:
         # Roll the pod when the rendered config changes.
         checksum/config: {{ include "texera.observability.lokiConfig" . | sha256sum }}
@@ -82,11 +50,7 @@ spec:
           image: {{ .Values.observability.logs.image }}
           imagePullPolicy: {{ .Values.texeraImages.pullPolicy }}
           args: ["-config.file=/etc/loki/config.yaml"]
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
+          {{- include "texera.observability.containerSecurityContext" true | nindent 10 }}
           ports:
             - name: http
               containerPort: {{ .Values.observability.logs.port }}
@@ -117,20 +81,7 @@ spec:
         - name: tmp
           emptyDir: {}
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Release.Name }}-loki
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-loki
-spec:
-  type: ClusterIP
-  selector:
-    app: {{ .Release.Name }}-loki
-  ports:
-    - name: http
-      protocol: TCP
-      port: {{ .Values.observability.logs.port }}
-      targetPort: {{ .Values.observability.logs.port }}
+{{ include "texera.observability.service" (dict "release" .Release "app" "loki" "ports" (list
+    (dict "name" "http" "port" .Values.observability.logs.port)
+)) }}
 {{- end }}
diff --git a/bin/k8s/templates/base/observability/otel-collector.yaml b/bin/k8s/templates/base/observability/otel-collector.yaml
index 89c537317d8..d4455566cde 100644
--- a/bin/k8s/templates/base/observability/otel-collector.yaml
+++ b/bin/k8s/templates/base/observability/otel-collector.yaml
@@ -22,22 +22,7 @@ under the License.
 # k8s counterpart of the docker-compose otel-collector service. The
 # receiver Ports are exposed only on the ClusterIP Service (no Ingress),
 # mirroring the loopback-only posture of the compose deployment.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Release.Name }}-otel-collector
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-otel-collector
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: {{ .Release.Name }}-otel-collector
-  template:
-    metadata:
-      labels:
-        app: {{ .Release.Name }}-otel-collector
+{{ include "texera.deploymentHeader" (dict "release" .Release "name" "otel-collector" "replicas" 1) }}
       annotations:
         # Roll the pod when the rendered config changes.
         checksum/config: {{ include (print $.Template.BasePath "/base/observability/otel-collector-configmap.yaml") . | sha256sum }}
@@ -51,11 +36,7 @@ spec:
           image: {{ .Values.observability.collector.image }}
           imagePullPolicy: {{ .Values.texeraImages.pullPolicy }}
           args: ["--config=/etc/otelcol-contrib/config.yaml"]
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
+          {{- include "texera.observability.containerSecurityContext" true | nindent 10 }}
           ports:
             - name: otlp-grpc
               containerPort: {{ .Values.observability.collector.grpcPort }}
@@ -72,24 +53,8 @@ spec:
           configMap:
             name: {{ .Release.Name }}-otel-collector-config
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Release.Name }}-otel-collector
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-otel-collector
-spec:
-  type: ClusterIP
-  selector:
-    app: {{ .Release.Name }}-otel-collector
-  ports:
-    - name: otlp-grpc
-      protocol: TCP
-      port: {{ .Values.observability.collector.grpcPort }}
-      targetPort: {{ .Values.observability.collector.grpcPort }}
-    - name: otlp-http
-      protocol: TCP
-      port: {{ .Values.observability.collector.httpPort }}
-      targetPort: {{ .Values.observability.collector.httpPort }}
+{{ include "texera.observability.service" (dict "release" .Release "app" "otel-collector" "ports" (list
+    (dict "name" "otlp-grpc" "port" .Values.observability.collector.grpcPort)
+    (dict "name" "otlp-http" "port" .Values.observability.collector.httpPort)
+)) }}
 {{- end }}
diff --git a/bin/k8s/templates/base/observability/victoriametrics.yaml b/bin/k8s/templates/base/observability/victoriametrics.yaml
index 5a6a1ea97b8..7e2ba427b13 100644
--- a/bin/k8s/templates/base/observability/victoriametrics.yaml
+++ b/bin/k8s/templates/base/observability/victoriametrics.yaml
@@ -21,41 +21,9 @@ under the License.
 # VictoriaMetrics: metrics store, k8s counterpart of the docker-compose
 # victoriametrics service. Accepts Prometheus remote-write from the
 # collector; MetricsQL query API on the same port.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: {{ .Release.Name }}-victoriametrics-data
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-victoriametrics
-spec:
-  accessModes: ["ReadWriteOnce"]
-  {{- if .Values.observability.metrics.storageClass }}
-  storageClassName: {{ .Values.observability.metrics.storageClass }}
-  {{- end }}
-  resources:
-    requests:
-      storage: {{ .Values.observability.metrics.storage }}
+{{ include "texera.observability.dataClaim" (dict "release" .Release "app" "victoriametrics" "storage" .Values.observability.metrics) }}
 ---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Release.Name }}-victoriametrics
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-victoriametrics
-spec:
-  replicas: 1
-  # Single writer bound to one RWO volume; never run two at once.
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: {{ .Release.Name }}-victoriametrics
-  template:
-    metadata:
-      labels:
-        app: {{ .Release.Name }}-victoriametrics
+{{ include "texera.deploymentHeader" (dict "release" .Release "name" "victoriametrics" "replicas" 1 "recreate" true) }}
     spec:
       securityContext:
         runAsNonRoot: true
@@ -69,11 +37,7 @@ spec:
             - "-storageDataPath=/data"
             - "-retentionPeriod={{ .Values.observability.metrics.retentionPeriod }}"
             - "-httpListenAddr=:{{ .Values.observability.metrics.port }}"
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
+          {{- include "texera.observability.containerSecurityContext" true | nindent 10 }}
           ports:
             - name: http
               containerPort: {{ .Values.observability.metrics.port }}
@@ -93,20 +57,7 @@ spec:
           persistentVolumeClaim:
             claimName: {{ .Release.Name }}-victoriametrics-data
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Release.Name }}-victoriametrics
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ .Release.Name }}-victoriametrics
-spec:
-  type: ClusterIP
-  selector:
-    app: {{ .Release.Name }}-victoriametrics
-  ports:
-    - name: http
-      protocol: TCP
-      port: {{ .Values.observability.metrics.port }}
-      targetPort: {{ .Values.observability.metrics.port }}
+{{ include "texera.observability.service" (dict "release" .Release "app" "victoriametrics" "ports" (list
+    (dict "name" "http" "port" .Values.observability.metrics.port)
+)) }}
 {{- end }}
diff --git a/bin/k8s/templates/base/postgresql/postgresql-persistence.yaml b/bin/k8s/templates/base/postgresql/postgresql-persistence.yaml
index edff7463b4a..fe50f544e80 100644
--- a/bin/k8s/templates/base/postgresql/postgresql-persistence.yaml
+++ b/bin/k8s/templates/base/postgresql/postgresql-persistence.yaml
@@ -20,59 +20,10 @@
 {{- $hostBasePath := .Values.persistence.postgresqlHostLocalPath }}
 
 {{- if .Values.postgresql.primary.persistence.enabled }}
-{{- $name := "postgresql" }}
-{{- $persistence := .Values.postgresql.primary.persistence }}
-{{- $volumeName := printf "%s-data-pv" $name }}
-{{- $claimName := printf "%s-data-pvc" $name }}
-{{- $storageClass := $persistence.storageClass | default "local-path" }}
-{{- $size := $persistence.size | default "10Gi" }}
-{{- $hostPath := printf "%s/%s/%s" $hostBasePath $.Release.Name $name }}
-
-{{/* Only create PV for local-path storage class */}}
-{{- if and (eq $storageClass "local-path") (ne $hostBasePath "") }}
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: {{ $volumeName }}
-  {{- if not $.Values.persistence.removeAfterUninstall }}
-  annotations:
-    "helm.sh/resource-policy": keep
-  {{- end }}
-  labels:
-    type: local
-    app: {{ $.Release.Name }}
-    component: {{ $name }}
-spec:
-  storageClassName: {{ $storageClass }}
-  capacity:
-    storage: {{ $size }}
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  hostPath:
-    path: {{ $hostPath }}
----
+{{ include "texera.localPersistence" (dict
+  "root" $
+  "name" "postgresql"
+  "persistence" .Values.postgresql.primary.persistence
+  "hostBasePath" $hostBasePath
+  "defaultSize" "10Gi") }}
 {{- end }}
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: {{ $claimName }}
-  namespace: {{ $.Release.Namespace }}
-  {{- if not $.Values.persistence.removeAfterUninstall }}
-  annotations:
-    "helm.sh/resource-policy": keep
-  {{- end }}
-  labels:
-    app: {{ $.Release.Name }}
-    component: {{ $name }}
-spec:
-  storageClassName: {{ $storageClass }}
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: {{ $size }}
-  {{- if and (eq $storageClass "local-path") (ne $hostBasePath "") }}
-  volumeName: {{ $volumeName }}
-  {{- end }}
-{{- end }} 
\ No newline at end of file
diff --git a/bin/k8s/templates/base/webserver/webserver-service.yaml b/bin/k8s/templates/base/webserver/webserver-service.yaml
index 43375cb0e70..0ed1f98a6a0 100644
--- a/bin/k8s/templates/base/webserver/webserver-service.yaml
+++ b/bin/k8s/templates/base/webserver/webserver-service.yaml
@@ -15,21 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.webserver.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.webserver.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.webserver.name }}
-  ports:
-    - name: api-port
-      protocol: TCP
-      port: {{ .Values.webserver.service.port }}
-      targetPort: {{ .Values.webserver.service.port }}
-      # if service type is set to NodePort, include nodePort attribute
-      {{- if eq .Values.webserver.service.type "NodePort" }}
-      nodePort: {{ .Values.webserver.service.nodePort }}
-      {{- end }}
\ No newline at end of file
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.webserver.name "serviceType" .Values.webserver.service.type "port" .Values.webserver.service.port "nodePort" .Values.webserver.service.nodePort "portName" "api-port" "useNodePort" true) }}
diff --git a/bin/k8s/templates/base/workflow-compiling-service/workflow-compiling-service-service.yaml b/bin/k8s/templates/base/workflow-compiling-service/workflow-compiling-service-service.yaml
index d08f51eafad..1c75e2328e5 100644
--- a/bin/k8s/templates/base/workflow-compiling-service/workflow-compiling-service-service.yaml
+++ b/bin/k8s/templates/base/workflow-compiling-service/workflow-compiling-service-service.yaml
@@ -15,21 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.workflowCompilingService.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.workflowCompilingService.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.workflowCompilingService.name }}
-  ports:
-    - name: api-port
-      protocol: TCP
-      port: {{ .Values.workflowCompilingService.service.port }}
-      targetPort: {{ .Values.workflowCompilingService.service.port }}
-      # if service type is set to NodePort, include nodePort attribute
-      {{- if eq .Values.workflowCompilingService.service.type "NodePort" }}
-      nodePort: {{ .Values.workflowCompilingService.service.nodePort }}
-      {{- end }}
\ No newline at end of file
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.workflowCompilingService.name "serviceType" .Values.workflowCompilingService.service.type "port" .Values.workflowCompilingService.service.port "nodePort" .Values.workflowCompilingService.service.nodePort "portName" "api-port" "useNodePort" true) }}
diff --git a/bin/k8s/templates/base/workflow-computing-unit-manager/workflow-computing-unit-manager-service.yaml b/bin/k8s/templates/base/workflow-computing-unit-manager/workflow-computing-unit-manager-service.yaml
index a3fac712264..a0f7cc7bf11 100644
--- a/bin/k8s/templates/base/workflow-computing-unit-manager/workflow-computing-unit-manager-service.yaml
+++ b/bin/k8s/templates/base/workflow-computing-unit-manager/workflow-computing-unit-manager-service.yaml
@@ -15,20 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.workflowComputingUnitManager.name }}-svc
-  namespace: {{ .Release.Namespace }}
-spec:
-  type: {{ .Values.workflowComputingUnitManager.service.type }}
-  selector:
-    app: {{ .Release.Name }}-{{ .Values.workflowComputingUnitManager.name }}
-  ports:
-    - protocol: TCP
-      port: {{ .Values.workflowComputingUnitManager.service.port }}
-      targetPort: {{ .Values.workflowComputingUnitManager.service.port }}
-      # if service type is set to NodePort, include nodePort attribute
-      {{- if eq .Values.workflowComputingUnitManager.service.type "NodePort" }}
-      nodePort: {{ .Values.workflowComputingUnitManager.service.nodePort }}
-      {{- end }}
\ No newline at end of file
+{{ include "texera.releaseService" (dict "release" .Release "name" .Values.workflowComputingUnitManager.name "serviceType" .Values.workflowComputingUnitManager.service.type "port" .Values.workflowComputingUnitManager.service.port "nodePort" .Values.workflowComputingUnitManager.service.nodePort "useNodePort" true) }}
diff --git a/bin/k8s/templates/on-prem/rustfs-persistence.yaml b/bin/k8s/templates/on-prem/rustfs-persistence.yaml
index dd0ce7cac89..771246ffa5a 100644
--- a/bin/k8s/templates/on-prem/rustfs-persistence.yaml
+++ b/bin/k8s/templates/on-prem/rustfs-persistence.yaml
@@ -20,59 +20,10 @@
 {{- $hostBasePath := .Values.persistence.rustfsHostLocalPath }}
 
 {{- if and .Values.rustfs.enabled .Values.rustfs.persistence.enabled }}
-{{- $name := "rustfs" }}
-{{- $persistence := .Values.rustfs.persistence }}
-{{- $volumeName := printf "%s-data-pv" $name }}
-{{- $claimName := printf "%s-data-pvc" $name }}
-{{- $storageClass := $persistence.storageClass | default "local-path" }}
-{{- $size := $persistence.size | default "20Gi" }}
-{{- $hostPath := printf "%s/%s/%s" $hostBasePath $.Release.Name $name }}
-
-{{/* Only create PV for local-path storage class */}}
-{{- if and (eq $storageClass "local-path") (ne $hostBasePath "") }}
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: {{ $volumeName }}
-  {{- if not $.Values.persistence.removeAfterUninstall }}
-  annotations:
-    "helm.sh/resource-policy": keep
-  {{- end }}
-  labels:
-    type: local
-    app: {{ $.Release.Name }}
-    component: {{ $name }}
-spec:
-  storageClassName: {{ $storageClass }}
-  capacity:
-    storage: {{ $size }}
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  hostPath:
-    path: {{ $hostPath }}
----
+{{ include "texera.localPersistence" (dict
+  "root" $
+  "name" "rustfs"
+  "persistence" .Values.rustfs.persistence
+  "hostBasePath" $hostBasePath
+  "defaultSize" "20Gi") }}
 {{- end }}
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: {{ $claimName }}
-  namespace: {{ $.Release.Namespace }}
-  {{- if not $.Values.persistence.removeAfterUninstall }}
-  annotations:
-    "helm.sh/resource-policy": keep
-  {{- end }}
-  labels:
-    app: {{ $.Release.Name }}
-    component: {{ $name }}
-spec:
-  storageClassName: {{ $storageClass }}
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: {{ $size }}
-  {{- if and (eq $storageClass "local-path") (ne $hostBasePath "") }}
-  volumeName: {{ $volumeName }}
-  {{- end }}
-{{- end }} 
\ No newline at end of file