diff --git a/ansible/superset-deploy.yaml b/ansible/superset-deploy.yaml
index 75b4153..901c404 100644
--- a/ansible/superset-deploy.yaml
+++ b/ansible/superset-deploy.yaml
@@ -60,7 +60,7 @@
         name: superset
         chart_repo_url: "https://apache.github.io/superset"
         chart_ref: superset
-        chart_version: 0.10.0
+        chart_version: 0.12.0
         release_namespace: default
         values: "{{ lookup('template', 'templates/values.yaml.j2') | from_yaml }}"
         #dependency_update: true
diff --git a/ansible/templates/values.yaml.j2 b/ansible/templates/values.yaml.j2
index f582684..cb8563e 100644
--- a/ansible/templates/values.yaml.j2
+++ b/ansible/templates/values.yaml.j2
@@ -74,6 +74,7 @@ configOverrides:
     # Will allow user self registration, allowing to create Flask users from
     # Authorized User
     AUTH_USER_REGISTRATION = True
+    SECRET_KEY = '{{ secretKey }}'
 
 extraConfigs:
   import_datasources.yaml: |
diff --git a/ansible/vars/eqiad1-secrets.yaml b/ansible/vars/eqiad1-secrets.yaml
index ece1605..3070f57 100644
Binary files a/ansible/vars/eqiad1-secrets.yaml and b/ansible/vars/eqiad1-secrets.yaml differ
diff --git a/deploy.sh b/deploy.sh
index 438481b..903e3f0 100644
--- a/deploy.sh
+++ b/deploy.sh
@@ -29,7 +29,10 @@ python3 -m venv .venv/deploy
 source .venv/deploy/bin/activate
 pip install ansible==8.1.0 kubernetes==26.1.0 PyMySQL==1.1.0
 
-export KUBECONFIG=$(pwd)/tofu/kube.config
+cd tofu
+tofu init
+tofu apply -var datacenter=${datacenter} # -auto-approve
+export KUBECONFIG=$(pwd)/kube.config
 
-cd ansible
+cd ../ansible
 ansible-playbook superset-deploy.yaml --extra-vars "datacenter=${datacenter}"
diff --git a/tofu/123-3.tf b/tofu/123-3.tf
index 9e1bd29..123c02e 100644
--- a/tofu/123-3.tf
+++ b/tofu/123-3.tf
@@ -5,11 +5,6 @@ resource "openstack_containerinfra_cluster_v1" "k8s_123_3" {
   node_count          = var.workers[var.datacenter]
 }
 
-resource "local_file" "kube_config" {
-  content  = resource.openstack_containerinfra_cluster_v1.k8s_123_3.kubeconfig.raw_config
-  filename = "kube.config"
-}
-
 resource "openstack_containerinfra_clustertemplate_v1" "template_123_3" {
   name                  = "superset${var.name[var.datacenter]}-123-3"
   coe                   = "kubernetes"
diff --git a/tofu/123-4.tf b/tofu/123-4.tf
new file mode 100644
index 0000000..7f416cf
--- /dev/null
+++ b/tofu/123-4.tf
@@ -0,0 +1,33 @@
+resource "openstack_containerinfra_cluster_v1" "k8s_123_4" {
+  name                = "superset${var.name[var.datacenter]}-123-4"
+  cluster_template_id = resource.openstack_containerinfra_clustertemplate_v1.template_123_4.id
+  master_count        = 1
+  node_count          = var.workers[var.datacenter]
+}
+
+resource "local_file" "kube_config" {
+  content  = resource.openstack_containerinfra_cluster_v1.k8s_123_4.kubeconfig.raw_config
+  filename = "kube.config"
+}
+
+resource "openstack_containerinfra_clustertemplate_v1" "template_123_4" {
+  name                  = "superset${var.name[var.datacenter]}-123-4"
+  coe                   = "kubernetes"
+  dns_nameserver        = "8.8.8.8"
+  docker_storage_driver = "overlay2"
+  docker_volume_size    = "50"
+  external_network_id   = var.external_network_id[var.datacenter]
+  fixed_subnet          = var.fixed_subnet[var.datacenter]
+  fixed_network         = var.fixed_network[var.datacenter]
+  flavor                = var.worker_flavor[var.datacenter]
+  floating_ip_enabled   = "false"
+  image                 = var.image_name[var.datacenter]
+  master_flavor         = var.control_flavor[var.datacenter]
+  network_driver        = "flannel"
+
+  labels = {
+    kube_tag               = "v1.23.15-rancher1-linux-amd64"
+    hyperkube_prefix       = "docker.io/rancher/"
+    cloud_provider_enabled = "true"
+  }
+}