diff --git a/.dockerignore b/.dockerignore
index 4dce722dae3..0f114c15005 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -9,7 +9,6 @@ hail/.bloop/
 hail/.gradle/
 hail/.idea/
 hail/.pytest_cache/
-.git/
 hail/.ensime.cache.d/
 hail/.ensime_cache.d/
 hail/.ensime_cache/
diff --git a/.github/workflows/prod_deploy.yaml b/.github/workflows/prod_deploy.yaml
new file mode 100644
index 00000000000..4fc2fc62fbc
--- /dev/null
+++ b/.github/workflows/prod_deploy.yaml
@@ -0,0 +1,43 @@
+name: prod-deploy
+on:
+  push:
+    branches:
+      - main
+jobs:
+  invoke-prod-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: deploy to GCP
+        continue-on-error: true
+        run: |
+          DEPLOY_BATCH_URL_GCP=$(curl --fail --silent --show-error -X POST \
+              -H "Authorization: Bearer ${{ secrets.CI_TOKEN }}" \
+              -H "Content-Type:application/json" \
+              -d '{"steps": ["deploy_auth", "deploy_batch", "deploy_ci", "deploy_hailgenetics_image", "deploy_wheel", "upload_query_jar"], "sha": "${{ github.sha }}"}' \
+              https://ci.hail.populationgenomics.org.au/api/v1alpha/prod_deploy || echo "failed")
+          echo DEPLOY_BATCH_URL_GCP="$DEPLOY_BATCH_URL_GCP" >> $GITHUB_ENV
+
+      - name: deploy to Azure
+        continue-on-error: true
+        run: |
+          DEPLOY_BATCH_URL_AZURE=$(curl --fail --silent --show-error -X POST \
+              -H "Authorization: Bearer ${{ secrets.CI_TOKEN_AZURE }}" \
+              -H "Content-Type:application/json" \
+              -d '{"steps": ["deploy_auth", "deploy_batch", "deploy_ci", "upload_query_jar"], "sha": "${{ github.sha }}"}' \
+              https://ci.azhail.populationgenomics.org.au/api/v1alpha/prod_deploy || echo "failed")
+          echo DEPLOY_BATCH_URL_AZURE="$DEPLOY_BATCH_URL_AZURE" >> $GITHUB_ENV
+
+      - name: post to Slack
+        run: |
+          SLACK_MSG="Deploying Hail Batch:\n*GCP:* $DEPLOY_BATCH_URL_GCP\n*Azure:* $DEPLOY_BATCH_URL_AZURE"
+          curl --fail --silent --show-error -X POST \
+              -H "Authorization: Bearer ${{ secrets.SLACK_BOT_TOKEN }}" \
+              -H "Content-type: application/json" \
+              -d "{\"channel\": \"production-announcements\", \"text\": \"$SLACK_MSG\"}" \
+              https://slack.com/api/chat.postMessage
+
+      - name: check if any deploy failed
+        run: |
+          if [ "$DEPLOY_BATCH_URL_GCP" == "failed" ] || [ "$DEPLOY_BATCH_URL_AZURE" == "failed" ]; then
+            exit 1
+          fi
diff --git a/.gitignore b/.gitignore
index 108a935e55f..5bb09fbcca5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,6 +28,9 @@ node_modules
 GPATH
 GRTAGS
 GTAGS
+*.dylib
+*/hail.jar
+infra/.terraform.lock.hcl
 hail/python/hail/docs/experimental/hail.experimental.DB.rst
 hail/python/hailtop/batch/docs/api/
 hail/upload-qob-jar
@@ -46,4 +49,5 @@ wheel-container.tar
 hail/python/hail/backend/extra_classpath
 hail/python/hail/backend/hail.jar
 hail/install-editable
+_/
 .helix
diff --git a/amundsen/Makefile b/amundsen/Makefile
new file mode 100644
index 00000000000..f1adad9f537
--- /dev/null
+++ b/amundsen/Makefile
@@ -0,0 +1,12 @@
+include ../config.mk
+
+PYTHON := PYTHONPATH=$${PYTHONPATH:+$${PYTHONPATH}:}$(EXTRA_PYTHONPATH) python3
+
+JINJA_ENVIRONMENT = '{"code":{"sha":"$(shell git rev-parse --short=12 HEAD)"},"deploy":$(DEPLOY),"default_ns":{"name":"$(NAMESPACE)"},"global":{"docker_prefix":"$(DOCKER_PREFIX)","domain":"$(DOMAIN)","k8s_server_url":"$(KUBERNETES_SERVER_URL)"},"scope":"$(SCOPE)"}'
+
+.PHONY: deploy
+deploy:
+	! [ -z $(NAMESPACE) ]  # call this like: make deploy NAMESPACE=default
+	E=$(JINJA_ENVIRONMENT) && \
+	  python3 ../ci/jinja2_render.py $$E deployment.yaml deployment.yaml.out
+	kubectl -n $(NAMESPACE) apply -f deployment.yaml.out
diff --git a/amundsen/deployment.yaml b/amundsen/deployment.yaml
new file mode 100644
index 00000000000..8ee78b4e7e1
--- /dev/null
+++ b/amundsen/deployment.yaml
@@ -0,0 +1,81 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: amundsen-frontend
+  labels:
+    app: amundsen-frontend
+    hail.is/sha: "{{ code.sha }}"
+spec:
+  selector:
+    matchLabels:
+      app: amundsen-frontend
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: amundsen-frontend
+        hail.is/sha: "{{ code.sha }}"
+    spec:
+{% if deploy %}
+      priorityClassName: production
+      nodeSelector:
+        preemptible: "false"
+{% else %}
+      nodeSelector:
+        preemptible: "true"
+      tolerations:
+       - key: preemptible
+         value: "true"
+{% endif %}
+      containers:
+      - name: amundsen-frontend
+        image: {{ global.docker_prefix }}/amundsendev/amundsen-frontend:2.3.0
+        imagePullPolicy: Always
+        resources:
+          requests:
+            cpu: "20m"
+            memory: "20M"
+          limits:
+            cpu: "1"
+            memory: "1G"
+        ports:
+          - containerPort: 5000
+        env:
+{% if deploy %}
+          - name: FRONTEND_BASE
+            value: https://amundsen-frontend.hail.is
+          - name: SEARCHSERVICE_BASE
+            value: https://amundsen-search.hail.is
+          - name: METADATASERVICE_BASE
+            value: https://amundsen-metadata.hail.is
+{% else %}
+          - name: FRONTEND_BASE
+            value: https://internal.hail.is/{{ default_ns.name }}/amundsen-frontend
+          - name: SEARCHSERVICE_BASE
+            value: https://internal.hail.is/{{ default_ns.name }}/amundsen-search
+          - name: METADATASERVICE_BASE
+            value: https://internal.hail.is/{{ default_ns.name }}/amundsen-metadata
+{% endif %}
+          - name: LONG_RANDOM_STRING
+            value: 4532y7y2389faehuwfteyw8704y329
+        command: ["gunicorn"]
+        args: ['-w', '4', '--bind', ':5000', 'amundsen_application.wsgi']
+        readinessProbe:
+          httpGet:
+            path: "/healthcheck"
+            port: 5000
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          timeoutSeconds: 1
+          successThreshold: 1
+          failureThreshold: 5
+        livenessProbe:
+          httpGet:
+            path: "/healthcheck"
+            port: 5000
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          timeoutSeconds: 1
+          successThreshold: 1
+          failureThreshold: 5
diff --git a/auth/auth/driver/driver.py b/auth/auth/driver/driver.py
index f7f99917b68..5388b657d8a 100644
--- a/auth/auth/driver/driver.py
+++ b/auth/auth/driver/driver.py
@@ -442,7 +442,9 @@ async def _create_user(app, user, skip_trial_bp, cleanup):
         raise DatabaseConflictError
 
 
-async def create_user(app, user, skip_trial_bp=False):
+# 2023-11-16 mfranklin: disable trial bp because there's an auth problem
+#   https://hail.zulipchat.com/#narrow/stream/300487-Hail-Batch-Dev/topic/Issue.20creating.20users/near/401890787
+async def create_user(app, user, skip_trial_bp=True):
     cleanup: List[Callable[[], Awaitable[None]]] = []
     try:
         await _create_user(app, user, skip_trial_bp, cleanup)
diff --git a/batch/batch/batch.py b/batch/batch/batch.py
index fdffd053239..a2da5ba685b 100644
--- a/batch/batch/batch.py
+++ b/batch/batch/batch.py
@@ -48,8 +48,9 @@ def batch_record_to_dict(record: Dict[str, Any]) -> Dict[str, Any]:
         duration_ms = None
         duration = None
 
-    if record['cost_breakdown'] is not None:
-        record['cost_breakdown'] = cost_breakdown_to_dict(json.loads(record['cost_breakdown']))
+    cost_breakdown = record.get('cost_breakdown')
+    if cost_breakdown is not None:
+        cost_breakdown = cost_breakdown_to_dict(json.loads(cost_breakdown))
 
     batch_response = {
         'id': record['id'],
@@ -70,8 +71,8 @@ def batch_record_to_dict(record: Dict[str, Any]) -> Dict[str, Any]:
         'duration_ms': duration_ms,
         'duration': duration,
         'msec_mcpu': record['msec_mcpu'],
-        'cost': coalesce(record['cost'], 0),
-        'cost_breakdown': record['cost_breakdown'],
+        'cost': coalesce(record.get('cost'), 0),
+        'cost_breakdown': cost_breakdown,
     }
 
     attributes = json.loads(record['attributes'])
@@ -138,8 +139,9 @@ def job_record_to_dict(record: Dict[str, Any], name: Optional[str]) -> JobListEn
         exit_code = None
         duration = None
 
-    if record['cost_breakdown'] is not None:
-        record['cost_breakdown'] = cost_breakdown_to_dict(json.loads(record['cost_breakdown']))
+    cost_breakdown = record.get('cost_breakdown')
+    if cost_breakdown is not None:
+        cost_breakdown = cost_breakdown_to_dict(json.loads(cost_breakdown))
 
     return cast(
         JobListEntryV1Alpha,
@@ -152,9 +154,9 @@ def job_record_to_dict(record: Dict[str, Any], name: Optional[str]) -> JobListEn
             'state': record['state'],
             'exit_code': exit_code,
             'duration': duration,
-            'cost': coalesce(record['cost'], 0),
+            'cost': coalesce(record.get('cost'), 0),
             'msec_mcpu': record['msec_mcpu'],
-            'cost_breakdown': record['cost_breakdown'],
+            'cost_breakdown': cost_breakdown,
             'always_run': bool(record['always_run']),
             'display_state': None,
         },
diff --git a/batch/batch/cloud/gcp/driver/create_instance.py b/batch/batch/cloud/gcp/driver/create_instance.py
index 014ad7fdf35..502bae02306 100644
--- a/batch/batch/cloud/gcp/driver/create_instance.py
+++ b/batch/batch/cloud/gcp/driver/create_instance.py
@@ -311,6 +311,7 @@ def scheduling() -> dict:
 -e DOCKER_PREFIX=$DOCKER_PREFIX \
 -e DOCKER_ROOT_IMAGE=$DOCKER_ROOT_IMAGE \
 -e INSTANCE_CONFIG=$INSTANCE_CONFIG \
+-e DOCKER_PREFIX=$DOCKER_PREFIX \
 -e MAX_IDLE_TIME_MSECS=$MAX_IDLE_TIME_MSECS \
 -e BATCH_WORKER_IMAGE=$BATCH_WORKER_IMAGE \
 -e BATCH_WORKER_IMAGE_ID=$BATCH_WORKER_IMAGE_ID \
diff --git a/batch/batch/driver/instance_collection/pool.py b/batch/batch/driver/instance_collection/pool.py
index 39ff5046b60..42e2469e882 100644
--- a/batch/batch/driver/instance_collection/pool.py
+++ b/batch/batch/driver/instance_collection/pool.py
@@ -139,6 +139,7 @@ def __init__(
         self.worker_max_idle_time_secs = config.worker_max_idle_time_secs
         self.job_queue_scheduling_window_secs = config.job_queue_scheduling_window_secs
         self.min_instances = config.min_instances
+        self.label = config.label
 
         self.all_supported_regions = self.inst_coll_manager.regions
 
@@ -167,6 +168,7 @@ def config(self):
             'standing_worker_max_idle_time_secs': self.standing_worker_max_idle_time_secs,
             'worker_max_idle_time_secs': self.worker_max_idle_time_secs,
             'job_queue_scheduling_window_secs': self.job_queue_scheduling_window_secs,
+            'label': self.label,
         }
 
     def configure(self, pool_config: PoolConfig):
@@ -190,6 +192,7 @@ def configure(self, pool_config: PoolConfig):
         self.standing_worker_max_idle_time_secs = pool_config.standing_worker_max_idle_time_secs
         self.worker_max_idle_time_secs = pool_config.worker_max_idle_time_secs
         self.job_queue_scheduling_window_secs = pool_config.job_queue_scheduling_window_secs
+        self.label = pool_config.label
 
     def adjust_for_remove_instance(self, instance):
         super().adjust_for_remove_instance(instance)
diff --git a/batch/batch/driver/main.py b/batch/batch/driver/main.py
index ac6f99d756e..9380a4cd149 100644
--- a/batch/batch/driver/main.py
+++ b/batch/batch/driver/main.py
@@ -663,6 +663,8 @@ async def pool_config_update(request: web.Request, _) -> NoReturn:
             f'a non-negative integer less than or equal to max_live_instances {max_live_instances}',
         )
 
+        label = post['label']
+
         possible_worker_cores = []
         for cores in possible_cores_from_worker_type(pool.cloud, worker_type):
             if not worker_local_ssd_data_disk:
@@ -758,6 +760,7 @@ async def pool_config_update(request: web.Request, _) -> NoReturn:
             worker_max_idle_time_secs=worker_max_idle_time_secs,
             standing_worker_max_idle_time_secs=standing_worker_max_idle_time_secs,
             job_queue_scheduling_window_secs=job_queue_scheduling_window_secs,
+            label=label,
         )
 
         current_client_pool_config = json.loads(str(post['_pool_config_json']))
diff --git a/batch/batch/driver/templates/pool.html b/batch/batch/driver/templates/pool.html
index 6a62fb827e7..b6a720dbb46 100644
--- a/batch/batch/driver/templates/pool.html
+++ b/batch/batch/driver/templates/pool.html
@@ -29,6 +29,7 @@ <h2>Configuration</h2>
     <div>Worker max idle time in seconds: <input name="worker_max_idle_time_secs" value="{{ pool.worker_max_idle_time_secs }}" /></div>
     <div>Standing worker max idle time in seconds: <input name="standing_worker_max_idle_time_secs" value="{{ pool.standing_worker_max_idle_time_secs }}" /></div>
     <div>Job queue scheduling window in seconds: <input name="job_queue_scheduling_window_secs" value="{{ pool.job_queue_scheduling_window_secs }}" /></div>
+    <div>Label: <input name="label" value="{{ pool.label }}" /></div>
     <input type="hidden" name="_csrf" value="{{ csrf_token }}"/>
     <input type="hidden" name="_pool_config_json" value="{{ pool_config_json }}"/>
     <button>
diff --git a/batch/batch/front_end/front_end.py b/batch/batch/front_end/front_end.py
index d5348e5364a..bf5944897cb 100644
--- a/batch/batch/front_end/front_end.py
+++ b/batch/batch/front_end/front_end.py
@@ -269,6 +269,95 @@ async def _handle_api_error(f: Callable[P, Awaitable[T]], *args: P.args, **kwarg
         raise e.http_response()
 
 
+async def _query_batch_jobs_for_billing(request, batch_id):
+    db = request.app['db']
+
+    # batch has already been validated
+    where_conditions = ['(jobs.batch_id = %s)']
+    where_args = [batch_id]
+
+    last_job_id = request.query.get('last_job_id')
+    query_limit: str = request.query.get('limit')
+    limit = 300
+    if query_limit:
+        try:
+            limit = int(query_limit)
+        except ValueError as e:
+            raise web.HTTPBadRequest(reason=f'Bad value for "limit": {e}')
+    if not (0 < limit < 1e4):
+        raise web.HTTPBadRequest(reason=f'Limit must be between 1 and 10,000 (limit={limit})')
+
+    if last_job_id is not None:
+        last_job_id = int(last_job_id)
+        where_conditions.append('(jobs.job_id > %s)')
+        where_args.append(last_job_id)
+
+    sql = f'''
+    SELECT
+        jobs.batch_id as batch_id,
+        jobs.job_id as job_id,
+        jobs.state as state,
+        batches.user AS user
+    FROM jobs
+    INNER JOIN batches ON jobs.batch_id = batches.id
+    WHERE {' AND '.join(where_conditions)}
+    GROUP BY jobs.batch_id, jobs.job_id
+    ORDER BY jobs.batch_id, jobs.job_id ASC
+    LIMIT %s;
+    '''
+
+    jobs = [dict(record) async for record in db.select_and_fetchall(sql, (*where_args, limit))]
+    n_job_ids = len(jobs)
+    job_ids = [job['job_id'] for job in jobs]
+
+    if n_job_ids == 0:
+        return [], None
+    if n_job_ids == 1:
+        job_condition = 'job_id = %s'
+    else:
+        placeholders = ', '.join(['%s'] * n_job_ids)
+        job_condition = f'job_id IN ({placeholders})'
+
+    job_attributes_sql = f'''
+    SELECT job_id, `key`, `value`
+    FROM job_attributes
+    WHERE batch_id = %s AND {job_condition};
+    '''
+
+    job_resources_cost_sql = f'''
+    SELECT agg.job_id, r.resource, agg.`usage`, r.rate * agg.`usage` as total
+    FROM aggregated_job_resources_v3 agg
+    INNER JOIN resources r ON r.resource_id = agg.resource_id
+    WHERE agg.batch_id = %s AND agg.{job_condition}
+    '''
+
+    attributes_by_job = collections.defaultdict(dict)
+    async for record in db.select_and_fetchall(job_attributes_sql, (batch_id, *job_ids)):
+        attributes_by_job[record['job_id']][record['key']] = record['value']
+
+    resources_by_job = collections.defaultdict(lambda: collections.defaultdict(float))
+    totals_by_job = collections.defaultdict(lambda: collections.defaultdict(float))
+    async for record in db.select_and_fetchall(job_resources_cost_sql, (batch_id, *job_ids)):
+        resource = record['resource']
+        job_id = record['job_id']
+        # Add, in case there are multiple instances of resources with the same name
+        resources_by_job[job_id][resource] += record['usage']
+        totals_by_job[job_id][resource] += record['total']
+
+    for j in jobs:
+        job_id = j['job_id']
+        j['resources'] = resources_by_job.get(job_id, {})
+        # override cost if it already exists
+        j['cost'] = totals_by_job.get(job_id, {})
+        j['attributes'] = attributes_by_job.get(job_id, {})
+
+    last_job_id = None
+    if len(jobs) == limit:
+        last_job_id = jobs[-1]['job_id']
+
+    return jobs, last_job_id
+
+
 async def _query_job_group_jobs(
     request: web.Request,
     batch_id: int,
@@ -296,6 +385,81 @@ async def _query_job_group_jobs(
     return (jobs, last_job_id)
 
 
+@routes.get('/api/v1alpha/batches/completed')
+@auth.authenticated_users_only()
+async def get_completed_batches_ordered_by_completed_time(request, userdata):
+    db = request.app['db']
+    where_args = [userdata['username'], ROOT_JOB_GROUP_ID]
+    wheres = [
+        'billing_project_users.`user` = %s',
+        'billing_project_users.billing_project = batches.billing_project',
+        'batches.time_completed IS NOT NULL',
+        'NOT deleted',
+        'job_groups.job_group_id = %s',
+    ]
+
+    limit = 100
+    query_limit: str = request.query.get('limit')
+    if query_limit:
+        try:
+            limit = int(query_limit)
+        except ValueError as e:
+            raise web.HTTPBadRequest(reason=f'Bad value for "limit": {e}')
+
+    last_completed_timestamp = request.query.get('last_completed_timestamp')
+    if last_completed_timestamp:
+        where_args.append(int(last_completed_timestamp))
+        wheres.append('batches.time_completed < %s')
+
+    sql = f"""
+SELECT batches.*,
+  cancelled_t.cancelled IS NOT NULL AS cancelled,
+  job_groups_n_jobs_in_complete_states.n_completed,
+  job_groups_n_jobs_in_complete_states.n_succeeded,
+  job_groups_n_jobs_in_complete_states.n_failed,
+  job_groups_n_jobs_in_complete_states.n_cancelled,
+  cost_t.*
+FROM job_groups
+LEFT JOIN batches ON batches.id = job_groups.batch_id
+LEFT JOIN billing_projects
+    ON batches.billing_project = billing_projects.name
+LEFT JOIN job_groups_n_jobs_in_complete_states
+       ON job_groups.batch_id = job_groups_n_jobs_in_complete_states.id AND job_groups.job_group_id = job_groups_n_jobs_in_complete_states.job_group_id
+LEFT JOIN (
+  SELECT id, 1 AS cancelled
+  FROM job_groups_cancelled
+  WHERE job_group_id = %s
+) AS cancelled_t ON batches.id = cancelled_t.id
+STRAIGHT_JOIN billing_project_users
+    ON batches.billing_project = billing_project_users.billing_project
+LEFT JOIN LATERAL (
+  SELECT COALESCE(SUM(`usage` * rate), 0) AS cost, JSON_OBJECTAGG(resources.resource, COALESCE(`usage` * rate, 0)) AS cost_breakdown
+  FROM (
+    SELECT resource_id, CAST(COALESCE(SUM(`usage`), 0) AS SIGNED) AS `usage`
+    FROM aggregated_job_group_resources_v3
+    WHERE job_groups.batch_id = aggregated_job_group_resources_v3.batch_id AND job_groups.job_group_id = aggregated_job_group_resources_v3.job_group_id
+    GROUP BY resource_id
+  ) AS usage_t
+  LEFT JOIN resources ON usage_t.resource_id = resources.resource_id
+) AS cost_t ON TRUE
+WHERE
+    {' AND '.join(wheres)}
+ORDER BY batches.time_completed DESC
+LIMIT %s;
+    """
+
+    records = [
+        batch async for batch in db.select_and_fetchall(sql, (ROOT_JOB_GROUP_ID, *where_args, limit), query_name='get_completed_batches')
+    ]
+    # this comes out as a timestamp (rather than a formed date)
+    last_completed_timestamp = records[-1]['time_completed']
+    batches = [batch_record_to_dict(batch) for batch in records]
+    body = {'batches': batches}
+    if len(batches) == limit:
+        body['last_completed_timestamp'] = last_completed_timestamp
+    return web.json_response(body)
+
+
 async def _get_job_group_jobs(
     request: web.Request,
     batch_id: int,
@@ -374,6 +538,108 @@ async def _api_get_job_group_jobs(request, batch_id: int, job_group_id: int, ver
     return json_response(resp)
 
 
+@routes.get('/api/v1alpha/batches/{batch_id}/jobs/resources')
+@billing_project_users_only()
+async def get_jobs_for_billing(request, userdata, batch_id):
+    """
+    Get jobs for batch to check the amount of resources used.
+    Takes a "last_job_id" and "limit" parameter that can be used to implement paging.
+
+    Returns
+    -------
+    Example response:
+    {
+        "jobs": [{
+            "batch_id": 1,
+            "job_id": 1,
+            "state": "Error",
+            "user": "<user>",
+            "resources": {
+                "compute/n1-preemptible/1": 0,
+                "disk/local-ssd/1": 0,
+                "disk/pd-ssd/1": 0,
+                "ip-fee/1024/1": 0,
+                "memory/n1-preemptible/1": 0,
+                "service-fee/1": 0
+            },
+            "cost": {
+                "compute/n1-preemptible": 0.0,
+                "disk/local-ssd/1": 0.0,
+                "disk/pd-ssd/1": 0.0,
+                "ip-fee/1024/1": 0.0,
+                "memory/n1-preemptible/1": 0.0,
+                "service-fee/1": 0.0
+            },
+            "attributes": {
+                "name": "<name of job>"
+            }
+        }]
+    }
+    """
+
+    # just noting the @billing_project_users_only() decorator
+    #   does the permission checks for us
+    jobs, last_job_id = await _query_batch_jobs_for_billing(request, batch_id)
+    resp = {'jobs': jobs}
+    if last_job_id:
+        resp['last_job_id'] = last_job_id
+
+    return web.json_response(resp)
+
+
+@routes.get('/api/v1alpha/batches/{batch_id}/jobs/{job_id}/resource_usage')
+@billing_project_users_only()
+async def get_job_resource_usage(request: web.Request, _, batch_id: int) -> web.Response:
+    """
+    Get the resource_usage data for a job. The data is returned as a JSON object
+    transformed from a pandas DataFrame using the 'split' orientation.
+
+    Returns
+    -------
+    Example response:
+    {
+        // eg: input, main, output
+        "[job_stage]": {
+            "columns":[
+                "time_msecs",
+                "memory_in_bytes",
+                "cpu_usage",
+                "non_io_storage_in_bytes",
+                "io_storage_in_bytes",
+                "network_bandwidth_upload_in_bytes_per_second",
+                "network_bandwidth_download_in_bytes_per_second"
+            ],
+            "index":[0, 1, ...],
+            "data": [[<records>]],
+        }, ...
+    }
+    """
+
+    # pull this out separately as billing_project_users_only() does a permission
+    # check for us, but has a fixed signature
+    job_id = int(request.match_info['job_id'])
+
+    job_record = await _get_job_record(request.app, batch_id, job_id)
+
+    # effectively the auth check
+    if not job_record:
+        raise web.HTTPNotFound()
+
+    resources: Optional[Dict[str, Optional[pd.DataFrame]]] = await _get_job_resource_usage_from_record(
+        app=request.app, record=job_record, batch_id=batch_id, job_id=job_id
+    )
+
+    if not resources:
+        # empty response if not available yet
+        return web.json_response({})
+
+    return web.json_response({
+        stage: stage_resource.to_dict(orient='split')
+        for stage, stage_resource in resources.items()
+        if stage_resource is not None
+    })
+
+
 async def _get_job_record(app, batch_id, job_id):
     db: Database = app['db']
 
@@ -1142,6 +1408,7 @@ async def _create_jobs(
 
         worker_type = None
         machine_type = resources.get('machine_type')
+        pool_label = resources.get('pool_label') or ''
         preemptible = resources.get('preemptible', BATCH_JOB_DEFAULT_PREEMPTIBLE)
 
         if machine_type and machine_type not in valid_machine_types(cloud):
@@ -1150,6 +1417,9 @@ async def _create_jobs(
         if machine_type and ('cpu' in resources or 'memory' in resources):
             raise web.HTTPBadRequest(reason='cannot specify cpu and memory with machine_type')
 
+        if machine_type and pool_label:
+            raise web.HTTPBadRequest(reason='cannot specify pool label with machine_type')
+
         if spec['process']['type'] == 'jvm':
             jvm_requested_cpu = parse_cpu_in_mcpu(resources.get('cpu', BATCH_JOB_DEFAULT_CPU))
             if 'cpu' in resources and jvm_requested_cpu not in (1000, 2000, 4000, 8000):
@@ -1222,7 +1492,14 @@ async def _create_jobs(
         inst_coll_configs: InstanceCollectionConfigs = app['inst_coll_configs']
 
         result, exc = inst_coll_configs.select_inst_coll(
-            cloud, machine_type, preemptible, worker_type, req_cores_mcpu, req_memory_bytes, req_storage_bytes
+            cloud,
+            machine_type,
+            pool_label,
+            preemptible,
+            worker_type,
+            req_cores_mcpu,
+            req_memory_bytes,
+            req_storage_bytes,
         )
 
         if exc:
@@ -1236,6 +1513,7 @@ async def _create_jobs(
                 f'memory={resources.get("req_memory")}, '
                 f'storage={resources["req_storage"]}, '
                 f'preemptible={preemptible}, '
+                f'pool_label={pool_label}, '
                 f'machine_type={machine_type}'
             )
 
@@ -2252,7 +2530,7 @@ async def ui_delete_batch(request: web.Request, _, batch_id: int) -> NoReturn:
 async def ui_batches(request: web.Request, userdata: UserData) -> web.Response:
     session = await aiohttp_session.get_session(request)
     user = userdata['username']
-    q = request.query.get('q', f'user = {user}' if CURRENT_QUERY_VERSION == 2 else f'user:{user}')
+    q = request.query.get('q', '')
     last_batch_id = cast_query_param_to_int(request.query.get('last_batch_id'))
     try:
         result = await _handle_ui_error(session, _query_batches, request, user, q, CURRENT_QUERY_VERSION, last_batch_id)
diff --git a/batch/batch/front_end/validate.py b/batch/batch/front_end/validate.py
index 58977090b40..5ee1481f746 100644
--- a/batch/batch/front_end/validate.py
+++ b/batch/batch/front_end/validate.py
@@ -91,6 +91,7 @@
         'cpu': regex(CPU_REGEXPAT, CPU_REGEX),
         'storage': regex(STORAGE_REGEXPAT, STORAGE_REGEX),
         'machine_type': str_type,
+        'pool_label': str_type,
         'preemptible': bool_type,
     }),
     'secrets': listof(
diff --git a/batch/batch/globals.py b/batch/batch/globals.py
index 7e24e05e8fa..3485c5ba94a 100644
--- a/batch/batch/globals.py
+++ b/batch/batch/globals.py
@@ -1,4 +1,13 @@
-states = {'Pending', 'Ready', 'Creating', 'Running', 'Cancelled', 'Error', 'Failed', 'Success'}
+states = {
+    'Pending',
+    'Ready',
+    'Creating',
+    'Running',
+    'Cancelled',
+    'Error',
+    'Failed',
+    'Success',
+}
 
 complete_states = ('Cancelled', 'Error', 'Failed', 'Success')
 
diff --git a/batch/batch/inst_coll_config.py b/batch/batch/inst_coll_config.py
index 6277d7a251b..c1eb5f2bf7b 100644
--- a/batch/batch/inst_coll_config.py
+++ b/batch/batch/inst_coll_config.py
@@ -90,6 +90,7 @@ def from_record(record):
             worker_max_idle_time_secs=record['worker_max_idle_time_secs'],
             standing_worker_max_idle_time_secs=record['standing_worker_max_idle_time_secs'],
             job_queue_scheduling_window_secs=record['job_queue_scheduling_window_secs'],
+            label=record['label'],
         )
 
     async def update_database(self, db: Database):
@@ -110,7 +111,8 @@ async def update_database(self, db: Database):
     autoscaler_loop_period_secs = %s,
     worker_max_idle_time_secs = %s,
     standing_worker_max_idle_time_secs = %s,
-    job_queue_scheduling_window_secs = %s
+    job_queue_scheduling_window_secs = %s,
+    label = %s
 WHERE pools.name = %s;
 """,
             (
@@ -128,6 +130,7 @@ async def update_database(self, db: Database):
                 self.worker_max_idle_time_secs,
                 self.standing_worker_max_idle_time_secs,
                 self.job_queue_scheduling_window_secs,
+                self.label,
                 self.name,
             ),
         )
@@ -152,6 +155,7 @@ def __init__(
         worker_max_idle_time_secs: int,
         standing_worker_max_idle_time_secs: int,
         job_queue_scheduling_window_secs: int,
+        label: str,
     ):
         assert (
             min_instances <= max_live_instances <= max_instances
@@ -173,6 +177,7 @@ def __init__(
         self.worker_max_idle_time_secs = worker_max_idle_time_secs
         self.standing_worker_max_idle_time_secs = standing_worker_max_idle_time_secs
         self.job_queue_scheduling_window_secs = job_queue_scheduling_window_secs
+        self.label = label
 
     def instance_config(self, product_versions: ProductVersions, location: str) -> InstanceConfig:
         return instance_config_from_pool_config(self, product_versions, location)
@@ -329,13 +334,13 @@ async def refresh(self, db: Database):
         self.resource_rates = resource_rates
         self.product_versions.update(product_versions_data)
 
-    def select_cheapest_price_pool(self, cloud, cores_mcpu, memory_bytes, storage_bytes, preemptible):
+    def select_cheapest_price_pool(self, cloud, pool_label, cores_mcpu, memory_bytes, storage_bytes, preemptible):
         assert self.resource_rates is not None
 
         optimal_result = None
         optimal_price = None
         for pool in self.name_pool_config.values():
-            if pool.cloud != cloud or pool.preemptible != preemptible:
+            if pool.cloud != cloud or pool.preemptible != preemptible or pool.label != pool_label:
                 continue
 
             result = pool.convert_requests_to_resources(cores_mcpu, memory_bytes, storage_bytes)
@@ -362,9 +367,16 @@ def select_cheapest_price_pool(self, cloud, cores_mcpu, memory_bytes, storage_by
                     optimal_result = (pool.name, maybe_cores_mcpu, maybe_memory_bytes, maybe_storage_gib)
         return optimal_result
 
-    def select_pool_from_worker_type(self, cloud, worker_type, cores_mcpu, memory_bytes, storage_bytes, preemptible):
+    def select_pool_from_worker_type(
+        self, cloud, pool_label, worker_type, cores_mcpu, memory_bytes, storage_bytes, preemptible
+    ):
         for pool in self.name_pool_config.values():
-            if pool.cloud == cloud and pool.worker_type == worker_type and pool.preemptible == preemptible:
+            if (
+                pool.cloud == cloud
+                and pool.worker_type == worker_type
+                and pool.preemptible == preemptible
+                and pool.label == pool_label
+            ):
                 result = pool.convert_requests_to_resources(cores_mcpu, memory_bytes, storage_bytes)
                 if result:
                     actual_cores_mcpu, actual_memory_bytes, acutal_storage_gib = result
@@ -377,11 +389,20 @@ def select_job_private(self, cloud, machine_type, storage_bytes):
         return self.jpim_config.convert_requests_to_resources(machine_type, storage_bytes)
 
     def select_inst_coll(
-        self, cloud, machine_type, preemptible, worker_type, req_cores_mcpu, req_memory_bytes, req_storage_bytes
+        self,
+        cloud,
+        machine_type,
+        pool_label,
+        preemptible,
+        worker_type,
+        req_cores_mcpu,
+        req_memory_bytes,
+        req_storage_bytes,
     ):
         if worker_type is not None and machine_type is None:
             result = self.select_pool_from_worker_type(
                 cloud=cloud,
+                pool_label=pool_label,
                 worker_type=worker_type,
                 cores_mcpu=req_cores_mcpu,
                 memory_bytes=req_memory_bytes,
@@ -391,6 +412,7 @@ def select_inst_coll(
         elif worker_type is None and machine_type is None:
             result = self.select_cheapest_price_pool(
                 cloud=cloud,
+                pool_label=pool_label,
                 cores_mcpu=req_cores_mcpu,
                 memory_bytes=req_memory_bytes,
                 storage_bytes=req_storage_bytes,
diff --git a/batch/build-batch-worker-image-startup-gcp.sh b/batch/build-batch-worker-image-startup-gcp.sh
index 5891954d0ac..8fd460074ad 100644
--- a/batch/build-batch-worker-image-startup-gcp.sh
+++ b/batch/build-batch-worker-image-startup-gcp.sh
@@ -58,9 +58,10 @@ apt-get install -y g++-12
 update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 50
 update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-12 50
 
-wget --no-verbose https://us.download.nvidia.com/XFree86/Linux-x86_64/530.30.02/NVIDIA-Linux-x86_64-530.30.02.run
-chmod +x NVIDIA-Linux-x86_64-530.30.02.run
-./NVIDIA-Linux-x86_64-530.30.02.run --silent
+NVIDIA_VERSION=555.58.02
+wget --no-verbose https://us.download.nvidia.com/XFree86/Linux-x86_64/$NVIDIA_VERSION/NVIDIA-Linux-x86_64-$NVIDIA_VERSION.run
+chmod +x NVIDIA-Linux-x86_64-$NVIDIA_VERSION.run
+./NVIDIA-Linux-x86_64-$NVIDIA_VERSION.run --ui=none --no-questions > /var/log/nvidia-run.log
 
 apt-get --yes install nvidia-container-toolkit
 nvidia-ctk runtime configure --runtime=docker
diff --git a/batch/gcp-create-worker-image.sh b/batch/gcp-create-worker-image.sh
index 6b723976db4..b620f20669a 100755
--- a/batch/gcp-create-worker-image.sh
+++ b/batch/gcp-create-worker-image.sh
@@ -24,7 +24,7 @@ else
     BUILDER=build-batch-worker-$NAMESPACE-image
 fi
 
-UBUNTU_IMAGE=ubuntu-minimal-2204-jammy-v20230726
+UBUNTU_IMAGE=ubuntu-minimal-2204-jammy-v20240701
 
 create_build_image_instance() {
     gcloud -q compute --project ${PROJECT} instances delete \
diff --git a/batch/sql/add-pool-label.sql b/batch/sql/add-pool-label.sql
new file mode 100644
index 00000000000..a3c006f8b4e
--- /dev/null
+++ b/batch/sql/add-pool-label.sql
@@ -0,0 +1 @@
+ALTER TABLE `pools` ADD `label` VARCHAR(100) NOT NULL;
diff --git a/batch/sql/add-seqr-pools.sql b/batch/sql/add-seqr-pools.sql
new file mode 100644
index 00000000000..31967000c2e
--- /dev/null
+++ b/batch/sql/add-seqr-pools.sql
@@ -0,0 +1,43 @@
+-- Adds dedicated pools for the seqr loading pipeline, with the 'seqr' pool label.
+
+INSERT INTO inst_colls (`name`, `is_pool`, `boot_disk_size_gb`, `max_instances`, `max_live_instances`, `cloud`)
+SELECT 'seqr-standard', 1, boot_disk_size_gb, max_instances, max_live_instances, cloud
+FROM inst_colls
+WHERE name = 'standard';
+
+INSERT INTO inst_colls (`name`, `is_pool`, `boot_disk_size_gb`, `max_instances`, `max_live_instances`, `cloud`)
+SELECT 'seqr-highmem', 1, boot_disk_size_gb, max_instances, max_live_instances, cloud
+FROM inst_colls
+WHERE name = 'highmem';
+
+INSERT INTO inst_colls (`name`, `is_pool`, `boot_disk_size_gb`, `max_instances`, `max_live_instances`, `cloud`)
+SELECT 'seqr-highcpu', 1, boot_disk_size_gb, max_instances, max_live_instances, cloud
+FROM inst_colls
+WHERE name = 'highcpu';
+
+INSERT INTO pools (`name`, `worker_type`, `worker_cores`, `worker_local_ssd_data_disk`,
+  `worker_external_ssd_data_disk_size_gb`, `enable_standing_worker`, `standing_worker_cores`,
+  `preemptible`, `label`)
+SELECT 'seqr-standard', worker_type, worker_cores, worker_local_ssd_data_disk,
+  worker_external_ssd_data_disk_size_gb, FALSE, standing_worker_cores,
+  TRUE, 'seqr'
+FROM pools
+WHERE name = 'standard';
+
+INSERT INTO pools (`name`, `worker_type`, `worker_cores`, `worker_local_ssd_data_disk`,
+  `worker_external_ssd_data_disk_size_gb`, `enable_standing_worker`, `standing_worker_cores`,
+  `preemptible`, `label`)
+SELECT 'seqr-highmem', worker_type, worker_cores, worker_local_ssd_data_disk,
+  worker_external_ssd_data_disk_size_gb, FALSE, standing_worker_cores,
+  TRUE, 'seqr'
+FROM pools
+WHERE name = 'highmem';
+
+INSERT INTO pools (`name`, `worker_type`, `worker_cores`, `worker_local_ssd_data_disk`,
+  `worker_external_ssd_data_disk_size_gb`, `enable_standing_worker`, `standing_worker_cores`,
+  `preemptible`, `label`)
+SELECT 'seqr-highcpu', worker_type, worker_cores, worker_local_ssd_data_disk,
+  worker_external_ssd_data_disk_size_gb, FALSE, standing_worker_cores,
+  TRUE, 'seqr'
+FROM pools
+WHERE name = 'highcpu';
diff --git a/batch/sql/fix-job-groups-state-enum.sql b/batch/sql/fix-job-groups-state-enum.sql
index 7e145d3af49..ddcb41cb700 100644
--- a/batch/sql/fix-job-groups-state-enum.sql
+++ b/batch/sql/fix-job-groups-state-enum.sql
@@ -6,7 +6,8 @@ FOR EACH ROW
 BEGIN
   DECLARE jg_state VARCHAR(40);
 
-  SET jg_state = IF(NEW.state = "open", "complete", NEW.state);
+  -- 2023-11-14: IF() patched locally to account for CPG database state
+  SET jg_state = IF(NEW.state = "running", "running", "complete");
 
   IF OLD.migrated_batch = 0 AND NEW.migrated_batch = 1 THEN
     INSERT INTO job_groups (batch_id, job_group_id, `user`, cancel_after_n_failures, `state`, n_jobs, time_created, time_completed, callback, attributes)
diff --git a/blog/deployment.yaml b/blog/deployment.yaml
index 8b25145fef7..9237481588d 100644
--- a/blog/deployment.yaml
+++ b/blog/deployment.yaml
@@ -50,6 +50,13 @@ spec:
         - mountPath: /ssl-config
           name: ssl-config-blog
           readOnly: true
+        resources:
+          requests:
+            memory: 338Mi
+            cpu: 90m
+          limits:
+            memory: 3375Mi
+            cpu: 900m
       - name: blog
         image: ghost:3.0-alpine
         env:
diff --git a/build.yaml b/build.yaml
index 5f45bece7df..0f87a49ff26 100644
--- a/build.yaml
+++ b/build.yaml
@@ -57,9 +57,6 @@ steps:
         clouds:
           - gcp
       - name: hail-ci-0-1-service-account-key
-      - name: test-dataproc-service-account-key
-        clouds:
-          - gcp
       - name: batch-worker-ssh-public-key
         clouds:
           - azure
@@ -2091,6 +2088,8 @@ steps:
         script: /io/sql/kill-mjc-deadlocks.sql
       - name: add-nonpreemptible-pools
         script: /io/sql/add-nonpreemptible-pools.sql
+      - name: add-pool-label
+        script: /io/sql/add-pool-label.sql
       - name: set-test-and-dev-pools-to-8-core-max-2
         script: /io/sql/set-test-and-dev-pools-to-8-core-max-2.py
       - name: set-test-and-dev-jpim-to-max-5
@@ -2849,7 +2848,6 @@ steps:
       - ci_database
       - deploy_auth
       - deploy_batch
-      - create_ci_test_repo
       - create_ci_config
       - deploy_ci_agent
       - create_certs
@@ -3249,11 +3247,6 @@ steps:
         to: /io/hail_pip_version
       - from: /repo
         to: /io/repo
-    secrets:
-      - name: test-dataproc-service-account-key
-        namespace:
-          valueFrom: default_ns.name
-        mountPath: /test-dataproc-service-account-key
     scopes:
       - deploy
       - dev
@@ -3375,6 +3368,51 @@ steps:
       - make_docs
     clouds:
       - gcp
+  - kind: runImage
+    name: deploy_wheel
+    image:
+      valueFrom: ci_utils_image.image
+    script: |
+      set -ex
+      gcloud auth activate-service-account --key-file=/gsa-key/key.json
+      HAIL_WHEEL_FILE=hail-$(cat /io/hail_pip_version)-py3-none-any.whl
+      gcloud storage cp "/io/wheel/$HAIL_WHEEL_FILE" "gs://cpg-hail-ci/wheels/$HAIL_WHEEL_FILE"
+    inputs:
+      - from: /hail_pip_version
+        to: /io/hail_pip_version
+      - from: /wheel
+        to: /io/wheel
+    scopes:
+      - deploy
+      - dev
+    dependsOn:
+      - default_ns
+      - ci_utils_image
+      - build_hail_jar_and_wheel
+    clouds:
+      - gcp
+  - kind: runImage
+    name: deploy_hailgenetics_image
+    image:
+      valueFrom: ci_utils_image.image
+    script: |
+      set -ex
+      gcloud auth -q configure-docker australia-southeast1-docker.pkg.dev
+      skopeo copy docker://{{ hailgenetics_hail_image.image }} docker://australia-southeast1-docker.pkg.dev/hail-295901/hail/hailgenetics/hail:$(cat /io/hail_pip_version)
+      skopeo copy docker://{{ hailgenetics_hailtop_image.image }} docker://australia-southeast1-docker.pkg.dev/hail-295901/hail/hailgenetics/hailtop:$(cat /io/hail_pip_version)
+    inputs:
+      - from: /hail_pip_version
+        to: /io/hail_pip_version
+    scopes:
+      - deploy
+      - dev
+    dependsOn:
+      - default_ns
+      - ci_utils_image
+      - hailgenetics_hail_image
+      - hailgenetics_hailtop_image
+    clouds:
+      - gcp
   - kind: runImage
     name: mirror_hailgenetics_images
     image: quay.io/skopeo/stable:v1.13.2
diff --git a/cert_renewal.sh b/cert_renewal.sh
new file mode 100755
index 00000000000..3d578084c1d
--- /dev/null
+++ b/cert_renewal.sh
@@ -0,0 +1,105 @@
+#!/bin/bash
+
+# ASCII art as arrays of lines
+cat << 'EOF'
+MXKKKKMMMMMWKKKKNMMMMMMMMMMWKKXWKKKMWKKKKMMMMMKKKKKKMMKKKKXMMMMMMMMMMMMMMN0O0XXMKKKKKKKXWKKKKKNMMWKKKKKKKX
+MdccccKMMMMkcccc0MMMMMMMMMMXllONxcxWNkoccOMMMNkkcokkWNkdcxkMMMMMMMMMMMMWxlkOklcMkcokkkcxNkcokkodNNcokcokck
+MXlccccxN0dccccxWMMMMMMMMMMMolOOkcKMMKck0cOMMMMMlxMMMMM0cWMMMMMMMMMMMMMklWMMMNKMMloOl0KNMWcx00doNWxXMcOMOK
+MMWkloddlccccl0MMMMMMMMMMMMMolXXKcKMXcoxxocKMMMMlxMMMMM0cWMMddMMMMMMMMMOcNMMMWXMMldXxK0kMWcx0klkWMMMMcOMMM
+MMMNxlcccccodkNMMMMMMMMMMMMOllkNdldkolxNWxloONxxloxxWNxdldxxldMMMMMMMMMMOdddddxWxloxxxolNxlokMNdoKMkxloxXM
+MMkcccccoxdlccl0MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWWMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
+MOcccccxKKkcccccOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
+MoccccxxxxxxccccoMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
+MkcccclOXXOlccccOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
+MWkcccldkocccccOMMMMMMMMMMMXKKKKXWMMXKKKKKKNNKKWMNKKXNKKKKKKKWXKKXMXKKXMXKKKWMMMNKKKKWMMMMMMMMMMMMMMMMMMMM
+MMMXxdoccccclxNMMMMMMMMMMMM0llOOklKMOcoOkOcOKdclXKxcxXxcxOkdcNxcxOXOkcxW0dccoWMMKkcoONMMMMMMMMMMMMMMMMMMMM
+MMWOlcccclodooKMMMMMMMMMMMMMol0OxlKMWcokcKKNM0ckcOKcKMKcxocNKMXcOoco0cNMNldXcdMMMWckMMMMMMMMMMMMMMMMMMMMMM
+MNlccccd0KocccckMMMMMMMMMMMMolK0odXMWcdXkN0OM0cMXoocKMKc00kWxKMcclKcclMWooxxxlkMMWckMMKlXMMMMMMMMMMMMMMMMM
+MdccccKMMMMxcccc0MMMMMMMMMMkooxWM0okxodxxxdxNdoxKWxoXKdodxxdo0Mko0MKokXdodKMkdoxOdodxxdoXMMMMMMMMMMMMMMMMM
+MOkkkOMMMMMNkkkkKMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
+EOF
+
+# Check if the user is in the docker group
+# Print "Checking your docker permissions..." in yellow with an hourglass emoji all in a row
+printf "\n\n\e[33mChecking your docker permissions...\e[0m \e[33m⌛\e[0m\n"
+if id -nG "$USER" | grep -qw "docker"; then
+    # Print "You are in the docker group. Proceeding with the script..." in green with a rocket emoji
+    printf "\e[32mYou are in the docker group. Proceeding with the script...\e[0m \e[32m🚀\e[0m\n"
+    
+    # Check for a folder named 'hail' in the current directory. If it doesn't exist, clone from GitHub
+    if [ ! -d "hail" ]; then
+        # Print "Cloning 'hail' from GitHub..." in yellow with a dna emoji
+        printf "\e[33mNo 'hail' folder found. Cloning 'hail' from GitHub...\e[0m \e[33m🧬\e[0m\n"
+        git clone https://github.com/populationgenomics/hail.git
+        cd hail
+    else
+        # Print "Found 'hail' folder. Updating 'hail' from GitHub..." in yellow
+        printf "\e[33mFound 'hail' folder. Updating 'hail' from GitHub...\e[0m \e[33m🧬\e[0m\n"
+        cd hail
+    fi
+    git switch main
+    git pull
+
+    # Print "Setting up gcloud credentials..." in yellow
+    # If any of the following commands fail, the script will exit
+    printf "\e[33mSetting up gcloud credentials...\e[0m\n"
+    gcloud config set project hail-295901
+    gcloud config set compute/zone australia-southeast1-b
+    gcloud auth configure-docker australia-southeast1-docker.pkg.dev
+    gcloud container clusters get-credentials vdc
+
+    # If the commands above fail, the script will exit else print "gcloud credentials set successfully!" in green with a green check mark all in a row
+    if [ $? -eq 0 ]; then
+        printf "\e[32mgcloud credentials set successfully!\e[0m \e[32m✔️\e[0m\n"
+    else
+        printf "\e[31mError: gcloud credentials could not be set!\e[0m \e[31m✘\e[0m\n"
+        exit 1
+    fi
+
+    # Print "Generating certificates..." in yellow with a warning sign emoji
+    printf "\e[33mGenerating certificates...\e[0m \e[33m⚠️\e[0m\n"
+    cd letscencrypt
+    make run NAMESPACE=default
+
+    # If the command above fails, the script will exit else print "Certificates generated successfully!" in green with a green check mark
+    if [ $? -eq 0 ]; then
+        printf "\e[32mCertificates generated successfully!\e[0m \e[32m✔️\e[0m\n"
+    else
+        # Add red X emoji to the end of the line
+        printf "\e[31mError: Certificates could not be generated!\e[0m \e[31m✘\e[0m\n"
+        exit 1
+    fi
+
+    # Print "Restarting Hail services..." in yellow and add a warning sign emoji
+    printf "\e[33mRestarting Hail services...\e[0m \e[33m⚠️\e[0m\n"
+
+    export HAIL=$HOME/hail
+
+    SERVICES_TO_RESTART=$(python3 -c 'import os
+    import yaml
+    hail_dir = os.getenv("HAIL")
+    x = yaml.safe_load(open(f"{hail_dir}/tls/config.yaml"))["principals"]
+    print(",".join(x["name"] for x in x))')
+
+    kubectl delete pods -l "app in ($SERVICES_TO_RESTART)"
+
+    # If the command above fails, the script will exit else print "Hail services restarted successfully!" in green with a green check mark
+    if [ $? -eq 0 ]; then
+        printf "\e[32mHail services restarted successfully!\e[0m \e[32m✔️\e[0m\n"
+    else
+        printf "\e[31mError: Hail services could not be restarted!\e[0m \e[31m✘\e[0m\n"
+        exit 1
+    fi
+
+    # Verify the new certificates by checking the dates:
+    echo | openssl s_client -servername batch.hail.populationgenomics.org.au -connect batch.hail.populationgenomics.org.au:443 2>/dev/null | openssl x509 -noout -dates
+
+    # Print "Remember to turn off the VM to save costs!" in yellow and add a smiling face
+    printf "\e[33mRemember to turn off the VM to save costs!\e[0m \e[32m😊\e[0m\n"
+
+else
+    printf "\e[31mYou need to add your user to the docker group to continue!\e[0m \e[31m✘\e[0m\n"
+    printf "\e[31mYou can add yourself to the docker group by running the following command:\e[0m \e[31m\n"
+    printf "\e[31msudo usermod -aG docker \$USER\e[0m \e[31m\n"
+    exit 1
+fi
diff --git a/ci/bootstrap.py b/ci/bootstrap.py
index 57b1cdb873a..a8088ad322e 100644
--- a/ci/bootstrap.py
+++ b/ci/bootstrap.py
@@ -65,7 +65,7 @@ def __init__(
 
 async def docker_run(*args: str):
     script = ' '.join([shq(a) for a in args])
-    outerr = await check_shell_output(script)
+    outerr = await check_shell_output(script, echo=True)
     print(f'Container output: {outerr[0]!r}\n' f'Container error: {outerr[1]!r}')
 
     cid = outerr[0].decode('ascii').strip()
diff --git a/ci/ci/ci.py b/ci/ci/ci.py
index f383dc9ed7d..640395c1c04 100644
--- a/ci/ci/ci.py
+++ b/ci/ci/ci.py
@@ -45,8 +45,12 @@
 from .github import PR, WIP, FQBranch, MergeFailureBatch, Repo, UnwatchedBranch, WatchedBranch, select_random_teammate
 from .utils import gcp_logging_queries
 
-with open(os.environ.get('HAIL_CI_OAUTH_TOKEN', 'oauth-token/oauth-token'), 'r', encoding='utf-8') as f:
-    oauth_token = f.read().strip()
+oauth_path = os.environ.get('HAIL_CI_OAUTH_TOKEN', 'oauth-token/oauth-token')
+if os.path.exists(oauth_path):
+    with open(oauth_path, 'r', encoding='utf-8') as f:
+        oauth_token = f.read().strip()
+else:
+    oauth_token = None
 
 log = logging.getLogger('ci')
 
@@ -556,6 +560,61 @@ async def dev_deploy_branch(request: web.Request, userdata: UserData) -> web.Res
     return json_response({'sha': sha, 'batch_id': batch_id})
 
 
+# This is CPG-specific, as the Hail team redeploys by watching the main branch.
+@routes.post('/api/v1alpha/prod_deploy')
+@auth.authenticated_users_only()
+async def prod_deploy(request, userdata):
+    """Deploys the main branch to the production namespace ("default")."""
+    # Only allow access by "ci" or dev accounts.
+    if not (userdata['username'] == 'ci' or userdata['is_developer'] == 1):
+        raise web.HTTPForbidden(text='Not a developer OR ci')
+    app = request.app
+    try:
+        params = await request.json()
+    except Exception as e:
+        message = 'could not read body as JSON'
+        log.info('prod deploy failed: ' + message, exc_info=True)
+        raise web.HTTPBadRequest(text=message) from e
+
+    try:
+        steps = params['steps']
+    except Exception as e:
+        message = f'parameters are wrong; check the steps syntax.\n\n{params}'
+        log.info('prod deploy failed: ' + message, exc_info=True)
+        raise web.HTTPBadRequest(text=message) from e
+
+    if 'sha' not in params:
+        message = f'parameter "sha" is required.\n\n{params}'
+        log.info('prod deploy failed: ' + message, exc_info=True)
+        raise web.HTTPBadRequest(text=message)
+    if params['sha'] == 'HEAD':
+        message = (
+            f'SHA must be a specific commit hash, and can\'t be a HEAD reference. '
+            f'The reason is that HEAD can change in the middle of the deploy.\n\n{params}'
+        )
+        log.info('prod deploy failed: ' + message, exc_info=True)
+        raise web.HTTPBadRequest(text=message)
+
+    watched_branch = WatchedBranch(
+        index=0,
+        branch=FQBranch.from_short_str('populationgenomics/hail:main'),
+        deployable=True,
+        mergeable=False,
+        developers=[],
+    )
+    watched_branch.sha = params['sha']
+    await watched_branch._start_deploy(db=app[AppKeys.DB], batch_client=app[AppKeys.BATCH_CLIENT], steps=steps)
+
+    batch = watched_branch.deploy_batch
+    if not isinstance(batch, MergeFailureBatch):
+        url = deploy_config.external_url('ci', f'/batches/{batch.id}')
+        return web.Response(text=f'{url}\n')
+    else:
+        message = traceback.format_exc()
+        log.info('prod deploy failed: ' + message, exc_info=True)
+        raise web.HTTPBadRequest(text=f'starting prod deploy failed due to\n{message}') from batch.exception
+
+
 @routes.post('/api/v1alpha/batch_callback')
 async def batch_callback(request: web.Request):
     await asyncio.shield(batch_callback_handler(request))
diff --git a/ci/ci/github.py b/ci/ci/github.py
index 8adabce26fe..14cfa65c484 100644
--- a/ci/ci/github.py
+++ b/ci/ci/github.py
@@ -876,15 +876,6 @@ async def _update_deploy(self, batch_client, db: Database):
                 else:
                     self.deploy_state = 'failure'
 
-                if not is_test_deployment and self.deploy_state == 'failure':
-                    url = deploy_config.external_url('ci', f'/batches/{self.deploy_batch.id}')
-                    deploy_failure_message = f"""
-state: {self.deploy_state}
-branch: {self.branch.short_str()}
-sha: {self.sha}
-url: {url}
-"""
-                    await send_zulip_deploy_failure_message(deploy_failure_message, db, self.sha)
                 self.state_changed = True
 
     async def _heal_deploy(self, db: Database, batch_client: BatchClient, frozen: bool):
@@ -951,7 +942,7 @@ async def _heal(self, db: Database, batch_client: BatchClient, gh: gh_aiohttp.Gi
                 log.info(f'cancel batch {batch.id} for {attrs["pr"]} {attrs["source_sha"]} => {attrs["target_sha"]}')
                 await batch.cancel()
 
-    async def _start_deploy(self, db: Database, batch_client: BatchClient):
+    async def _start_deploy(self, db: Database, batch_client: BatchClient, steps=DEPLOY_STEPS):
         # not deploying
         assert not self.deploy_batch or self.deploy_state
 
@@ -967,7 +958,7 @@ async def _start_deploy(self, db: Database, batch_client: BatchClient):
 (cd {shq(repo_dir)}; {self.checkout_script()})
 """)
             with open(f'{repo_dir}/build.yaml', 'r', encoding='utf-8') as f:
-                config = BuildConfiguration(self, f.read(), requested_step_names=DEPLOY_STEPS, scope='deploy')
+                config = BuildConfiguration(self, f.read(), requested_step_names=steps, scope='deploy')
                 namespace = config.namespace()
                 services = config.deployed_services()
             with open(f'{repo_dir}/ci/test/resources/build.yaml', 'r', encoding='utf-8') as f:
@@ -987,19 +978,7 @@ async def _start_deploy(self, db: Database, batch_client: BatchClient):
                 },
                 callback=CALLBACK_URL,
             )
-            try:
-                config.build(deploy_batch, self, scope='deploy')
-            except Exception as e:
-                deploy_failure_message = f"""
-branch: {self.branch.short_str()}
-sha: {self.sha}
-Deploy config failed to build with exception:
-```python
-{e}
-```
-"""
-                await send_zulip_deploy_failure_message(deploy_failure_message, db, self.sha)
-                raise
+            config.build(deploy_batch, self, scope='deploy')
             await deploy_batch.submit()
             self.deploy_batch = deploy_batch
         except concurrent.futures.CancelledError:
diff --git a/ci/create_database.py b/ci/create_database.py
index fbabb64e956..d23d238deea 100644
--- a/ci/create_database.py
+++ b/ci/create_database.py
@@ -16,7 +16,7 @@
 
 
 async def migrate(database_name, db, mysql_cnf_file, i, migration):
-    print(f'applying migration {i} {migration}')
+    print(f'\nchecking migration {i} {migration}')
 
     # version to migrate to
     # the 0th migration migrates from 1 to 2
@@ -34,6 +34,7 @@ async def migrate(database_name, db, mysql_cnf_file, i, migration):
     current_version = row['version']
 
     if current_version + 1 == to_version:
+        print('applying')
         if not online:
             await _shutdown()
 
@@ -45,6 +46,7 @@ async def migrate(database_name, db, mysql_cnf_file, i, migration):
 mysql --defaults-extra-file={mysql_cnf_file} <{script}
 """)
 
+        print('recording as applied')
         await db.just_execute(
             f"""
 UPDATE `{database_name}_migration_version`
@@ -56,6 +58,7 @@ async def migrate(database_name, db, mysql_cnf_file, i, migration):
             (to_version, to_version, name, script_sha1),
         )
     else:
+        print('previously applied')
         assert current_version >= to_version
 
         # verify checksum
diff --git a/ci/deployment.yaml b/ci/deployment.yaml
index 69aa3102dc1..06953a59fb0 100644
--- a/ci/deployment.yaml
+++ b/ci/deployment.yaml
@@ -56,10 +56,7 @@ spec:
                  name: ci-config
                  key: github_context
            - name: HAIL_WATCHED_BRANCHES
-             valueFrom:
-               secretKeyRef:
-                 name: ci-config
-                 key: watched_branches
+             value: '[]'
            - name: HAIL_CI_DEPLOY_STEPS
              valueFrom:
                secretKeyRef:
@@ -124,9 +121,6 @@ spec:
            - name: gsa-key
              mountPath: /gsa-key
              readOnly: true
-           - mountPath: /zulip-config
-             name: zulip-config
-             readOnly: true
            - name: ssl-config-ci
              mountPath: /ssl-config
              readOnly: true
diff --git a/dev-docs/development-process.md b/dev-docs/development-process.md
index 4bb77530996..15fbfcb5317 100644
--- a/dev-docs/development-process.md
+++ b/dev-docs/development-process.md
@@ -63,7 +63,7 @@ Install and configure tools necessary for working on the Hail Services:
 gcloud auth login
 gcloud config set project hail-vdc
 gcloud container clusters get-credentials vdc --zone=us-central1-a
-gcloud auth -q configure-docker us-docker.pkg.dev
+gcloud auth -q configure-docker $REGION-docker.pkg.dev
 ```
 
 5. Add these lines to `~/.zshrc` or `~/.bashrc` to configure your shell and environment for
diff --git a/dev-docs/services/tls-cookbook.md b/dev-docs/services/tls-cookbook.md
index 0b6070bf065..70399905bfc 100644
--- a/dev-docs/services/tls-cookbook.md
+++ b/dev-docs/services/tls-cookbook.md
@@ -122,6 +122,8 @@ kubectl create secret generic \
 3. Update all the service certificates:
 
 ```
+export HAIL=$HOME/hail
+
 make -C $HAIL/hail python/hailtop/hail_version
 
 PYTHONPATH=$HAIL/hail/python \
diff --git a/hail/Makefile b/hail/Makefile
index 0398e46b59a..dc50d05537f 100644
--- a/hail/Makefile
+++ b/hail/Makefile
@@ -292,6 +292,12 @@ cloud_base := gs://hail-common/hailctl/dataproc/$(HAIL_PIP_VERSION)
 UPLOAD_RETENTION = gcloud storage objects update "$(cloud_base)/*" --temporary-hold
 endif
 
+DEV_CLARIFIER =
+CLOUD_SUB_FOLDER := $(HAIL_PIP_VERSION)
+
+HAILCTL_BUCKET_BASE ?= gs://hail-common/hailctl/dataproc
+
+cloud_base := $(HAILCTL_BUCKET_BASE)/$(DEV_CLARIFIER)$(CLOUD_SUB_FOLDER)
 wheel_cloud_path := $(cloud_base)/hail-$(HAIL_PIP_VERSION)-py3-none-any.whl
 resources := $(wildcard python/hailtop/hailctl/dataproc/resources/*)
 $(eval $(call ENV_VAR,cloud_base))
diff --git a/hail/python/hailtop/batch/backend.py b/hail/python/hailtop/batch/backend.py
index 4d31571eea2..3e330cfcb6d 100644
--- a/hail/python/hailtop/batch/backend.py
+++ b/hail/python/hailtop/batch/backend.py
@@ -843,6 +843,8 @@ async def compile_job(job):
                 resources['storage'] = job._storage
             if job._machine_type:
                 resources['machine_type'] = job._machine_type
+            if job._pool_label:
+                resources['pool_label'] = job._pool_label
             if job._preemptible is not None:
                 resources['preemptible'] = job._preemptible
 
@@ -918,6 +920,9 @@ async def compile_job(job):
         deploy_config = get_deploy_config()
         url = deploy_config.external_url('batch', f'/batches/{batch_id}')
 
+        if not wait:
+            print(f'Submitted batch {batch_id}, see {url}')
+
         if open:
             webbrowser.open(url)
         if wait and len(unsubmitted_jobs) > 0:
diff --git a/hail/python/hailtop/batch/job.py b/hail/python/hailtop/batch/job.py
index ffc63a086c4..05fafdc21a1 100644
--- a/hail/python/hailtop/batch/job.py
+++ b/hail/python/hailtop/batch/job.py
@@ -83,6 +83,7 @@ def __init__(
         self._always_run: bool = False
         self._preemptible: Optional[bool] = None
         self._machine_type: Optional[str] = None
+        self._pool_label: Optional[str] = None
         self._timeout: Optional[Union[int, float]] = None
         self._cloudfuse: List[Tuple[str, str, bool]] = []
         self._always_copy_output: bool = False
diff --git a/hail/python/hailtop/hailctl/dataproc/cli.py b/hail/python/hailtop/hailctl/dataproc/cli.py
index c97b2159e63..5e3ecb15f0d 100644
--- a/hail/python/hailtop/hailctl/dataproc/cli.py
+++ b/hail/python/hailtop/hailctl/dataproc/cli.py
@@ -191,6 +191,9 @@ def start(
     debug_mode: Ann[
         bool, Opt(help='Enable debug features on created cluster (heap dump on out-of-memory error)')
     ] = False,
+    public_ip_address: Ann[
+        bool, Opt(help='Allow nodes to have a public IP address, and hence make requests on the public internet (default is internal-only from dataproc 2.2).')
+    ] = False,
 ):
     """
     Start a Dataproc cluster configured for Hail.
@@ -243,6 +246,7 @@ def start(
         requester_pays_allow_annotation_db,
         debug_mode,
         use_gcloud_beta,
+        public_ip_address,
     )
 
 
diff --git a/hail/python/hailtop/hailctl/dataproc/start.py b/hail/python/hailtop/hailctl/dataproc/start.py
index 6e31d3a1563..f38fe5383f5 100755
--- a/hail/python/hailtop/hailctl/dataproc/start.py
+++ b/hail/python/hailtop/hailctl/dataproc/start.py
@@ -177,6 +177,7 @@ def start(
     requester_pays_allow_annotation_db: bool,
     debug_mode: bool,
     beta: bool,
+    public_ip_address: bool,
 ):
     conf = ClusterConfig()
     conf.extend_flag('image-version', IMAGE_VERSION)
@@ -395,6 +396,8 @@ def jvm_heap_size_gib(machine_type: str, memory_fraction: float) -> int:
         cmd.append('--expiration_time={}'.format(expiration_time))
     if service_account:
         cmd.append('--service-account={}'.format(service_account))
+    if public_ip_address:
+        cmd.append('--public-ip-address')
 
     cmd.extend(pass_through_args)
 
diff --git a/hail/python/hailtop/hailctl/dataproc/submit.py b/hail/python/hailtop/hailctl/dataproc/submit.py
index 1c075bc9a7b..56ac0006cf7 100644
--- a/hail/python/hailtop/hailctl/dataproc/submit.py
+++ b/hail/python/hailtop/hailctl/dataproc/submit.py
@@ -24,6 +24,9 @@ def submit(
         files_list = [os.path.expanduser(file) for file in files_list]
         files = ','.join(files_list)
 
+    def _filter_pyfile(fname: str) -> bool:
+        return not fname.endswith('.pyc')
+
     # If you only provide one (comma-sep) argument, and it's a zip file, use that file directly
     if not (pyfiles and pyfiles.endswith('.zip') and ',' not in pyfiles):
         pyfiles_list = []
@@ -35,12 +38,13 @@ def submit(
             with zipfile.ZipFile(tfile, 'w', zipfile.ZIP_DEFLATED) as zipf:
                 for _hail_script_entry in pyfiles_list:
                     hail_script_entry = os.path.expanduser(_hail_script_entry)
-                    if hail_script_entry.endswith('.py'):
+                    if os.path.isfile(hail_script_entry) and _filter_pyfile(hail_script_entry):
                         zipf.write(hail_script_entry, arcname=os.path.basename(hail_script_entry))
                     else:
                         for root, _, pyfiles_walk in os.walk(hail_script_entry):
                             for pyfile in pyfiles_walk:
-                                if pyfile.endswith('.py'):
+                                path = os.path.join(root, pyfile)
+                                if os.path.isfile(path) and _filter_pyfile(path):
                                     zipf.write(
                                         os.path.join(root, pyfile),
                                         os.path.relpath(
diff --git a/hail/python/hailtop/httpx.py b/hail/python/hailtop/httpx.py
index 6f420833e9f..022165d74b2 100644
--- a/hail/python/hailtop/httpx.py
+++ b/hail/python/hailtop/httpx.py
@@ -93,7 +93,7 @@ def __init__(
         tls = get_deploy_config().client_ssl_context()
         assert 'connector' not in kwargs
 
-        configuration_of_timeout = configuration_of(ConfigVariable.HTTP_TIMEOUT_IN_SECONDS, timeout, 5)
+        configuration_of_timeout = configuration_of(ConfigVariable.HTTP_TIMEOUT_IN_SECONDS, timeout, 20)
         del timeout
 
         if isinstance(configuration_of_timeout, str):
diff --git a/image-fetcher/Dockerfile b/image-fetcher/Dockerfile
new file mode 100644
index 00000000000..477122e8750
--- /dev/null
+++ b/image-fetcher/Dockerfile
@@ -0,0 +1,17 @@
+FROM {{ global.docker_prefix }}/alpine:3.8
+MAINTAINER hail-team@broadinstitute.org
+
+RUN apk --no-cache add \
+    bash \
+    curl \
+    python \
+    docker \
+    jq
+
+RUN curl -sSL https://sdk.cloud.google.com | bash
+ENV PATH $PATH:/root/google-cloud-sdk/bin
+
+ADD fetch-image.sh ./
+ENV DOCKER_PREFIX {{ global.docker_prefix }}
+
+CMD /bin/sh fetch-image.sh
diff --git a/image-fetcher/Makefile b/image-fetcher/Makefile
new file mode 100644
index 00000000000..2d51b4709c5
--- /dev/null
+++ b/image-fetcher/Makefile
@@ -0,0 +1,23 @@
+include ../config.mk
+
+.PHONY: build push deploy
+
+FETCH_LATEST = $(DOCKER_PREFIX)/image-fetcher:latest
+FETCH_IMAGE = $(DOCKER_PREFIX)/image-fetcher:$(shell docker images -q --no-trunc image-fetcher | sed -e 's,[^:]*:,,')
+
+build: fetch-image.sh
+	docker pull $(DOCKER_PREFIX)/alpine:3.8
+	-docker pull $(FETCH_LATEST)
+	python3 ../ci/jinja2_render.py '{"global":{"docker_prefix":"$(DOCKER_PREFIX)"}}' Dockerfile Dockerfile.out
+	docker build -f Dockerfile.out . -t image-fetcher --cache-from image-fetcher,$(FETCH_LATEST),$(DOCKER_PREFIX)/alpine:3.8
+
+push: build
+	docker tag image-fetcher $(FETCH_LATEST)
+	docker push $(FETCH_LATEST)
+	docker tag image-fetcher $(FETCH_IMAGE)
+	docker push $(FETCH_IMAGE)
+
+deploy: push
+	! [ -z $(NAMESPACE) ]  # call this like: make deploy NAMESPACE=default
+	python3 ../ci/jinja2_render.py '{"deploy": $(DEPLOY), "code":{"sha": "$(shell git rev-parse --short=12 HEAD)"}, "image_fetcher_image":{"image":"$(FETCH_IMAGE)"}}' deployment.yaml deployment.yaml.out
+	kubectl -n $(NAMESPACE) apply -f deployment.yaml.out
diff --git a/image-fetcher/fetch-image.sh b/image-fetcher/fetch-image.sh
new file mode 100644
index 00000000000..2abb9e363e9
--- /dev/null
+++ b/image-fetcher/fetch-image.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+set -e
+
+docker_registry=${DOCKER_PREFIX%%/*}
+
+gcloud_auth() {
+    gcloud -q auth activate-service-account --key-file=/secrets/gcr-pull.json && \
+        gcloud -q auth configure-docker "${docker_registry}"
+}
+
+if ! gcloud_auth > gcloud-auth.log 2>&1; then
+    1>&2 cat gcloud-auth.log
+    exit 1
+else
+    cat gcloud-auth.log
+fi
+
+DEFAULT_NAMESPACE=$(jq -r '.default_namespace' < /deploy-config/deploy-config.json)
+case $DEFAULT_NAMESPACE in
+    default)
+	NOTEBOOK_BASE_PATH=''
+	;;
+    *)
+	NOTEBOOK_BASE_PATH="/$DEFAULT_NAMESPACE/notebook"
+	;;
+esac
+
+ln -s /ssl-config/ssl-config.curlrc "$HOME/.curlrc"
+
+echo "Namespace: $DEFAULT_NAMESPACE; Home: $HOME"
+while true; do
+    if curl -sSL "https://notebook$NOTEBOOK_BASE_PATH/images" > image-fetch-output.log 2>&1;
+    then
+        for image in "$DOCKER_PREFIX/base:latest" \
+                         gcr.io/google.com/cloudsdktool/cloud-sdk:310.0.0-alpine \
+                         $(cat image-fetch-output.log); do
+            docker pull "$image" || true
+        done
+        sleep 360
+    else
+        1>&2 cat image-fetch-output.log
+    fi
+done
diff --git a/infra/azure/modules/db/main.tf b/infra/azure/modules/db/main.tf
index 87b5da35e63..e5f94491124 100644
--- a/infra/azure/modules/db/main.tf
+++ b/infra/azure/modules/db/main.tf
@@ -38,7 +38,14 @@ resource "azurerm_mysql_flexible_server" "db" {
   # availability zones enabled in AKS.
   # Sometimes zones are not available in particular regions
   # In this case either change to an appropriate zone or comment the below line out
-  zone = 1
+  # Commented out due to the following error:
+  # │ Error: waiting for creation of Flexible Server: (Name "db-2138b3b3" / Resource Group "hail"): Code="AvailableZoneNotFound" Message="The availiabilityZone '1' is not found for subscription id '4453ab2e-2015-4bf0-adf2-7b2fa1f207e3'."
+  # │
+  # │   with module.db.azurerm_mysql_flexible_server.db,
+  # │   on modules/db/main.tf line 22, in resource "azurerm_mysql_flexible_server" "db":
+  # │   22: resource "azurerm_mysql_flexible_server" "db" {
+  # │
+  # zone = 1
 
   delegated_subnet_id = var.subnet_id
   private_dns_zone_id = azurerm_private_dns_zone.db.id
diff --git a/infra/gcp/bootstrap.sh b/infra/gcp/bootstrap.sh
index 85ffd30946d..bbfaf389946 100755
--- a/infra/gcp/bootstrap.sh
+++ b/infra/gcp/bootstrap.sh
@@ -3,11 +3,9 @@
 source ../bootstrap_utils.sh
 
 function configure_gcloud() {
-    ZONE=${1:-"us-central1-a"}
-    REGION=${2:-"us"}
+    ZONE=${1:-"australia-southeast1-b"}
+    REGION=${2:-"australia-southeast1"}
 
-    # If you are using the Container Registry:
-    # gcloud -q auth configure-docker
     gcloud -q auth configure-docker $REGION-docker.pkg.dev
     gcloud container clusters get-credentials --zone $ZONE vdc
 }
diff --git a/infra/gcp/gcs_bucket/main.tf b/infra/gcp/gcs_bucket/main.tf
index 01fbba71d90..9827732380c 100644
--- a/infra/gcp/gcs_bucket/main.tf
+++ b/infra/gcp/gcs_bucket/main.tf
@@ -7,4 +7,5 @@ resource "google_storage_bucket" "bucket" {
   location = var.location
   force_destroy = true
   storage_class = var.storage_class
+  uniform_bucket_level_access = true
 }
diff --git a/infra/gcp/main.tf b/infra/gcp/main.tf
index 4fce67a8186..5f8ca7f8965 100644
--- a/infra/gcp/main.tf
+++ b/infra/gcp/main.tf
@@ -13,6 +13,9 @@ terraform {
       version = "0.6.3"
     }
   }
+  backend "gcs" {
+    bucket = "cpg-hail-terraform"
+  }
 }
 
 variable "k8s_preemptible_node_pool_name" {
@@ -412,11 +415,6 @@ resource "google_artifact_registry_repository_iam_member" "artifact_registry_pus
   member = "serviceAccount:${google_service_account.gcr_push.email}"
 }
 
-module "ukbb" {
-  count = var.deploy_ukbb ? 1 : 0
-  source = "../k8s/ukbb"
-}
-
 module "auth_gsa_secret" {
   source = "./gsa_k8s_secret"
   name = "auth"
@@ -659,6 +657,20 @@ resource "google_compute_firewall" "default_allow_internal" {
   }
 }
 
+resource "google_compute_firewall" "allow_ssh" {
+  name = "allow-ssh"
+  network = google_compute_network.default.name
+
+  priority = 65534
+
+  source_ranges = ["0.0.0.0/0"]
+
+  allow {
+    protocol = "tcp"
+    ports = ["22"]
+  }
+}
+
 resource "google_compute_firewall" "vdc_to_batch_worker" {
   name    = "vdc-to-batch-worker"
   network = google_compute_network.default.name
@@ -756,6 +768,10 @@ data "sops_file" "auth_oauth2_client_secret_sops" {
   source_file = "${var.github_organization}/auth_oauth2_client_secret.enc.json"
 }
 
+data "sops_file" "hailctl_client_secret_sops" {
+  source_file = "${var.github_organization}/hailctl_client_secret.enc.json"
+}
+
 resource "kubernetes_secret" "auth_oauth2_client_secret" {
   metadata {
     name = "auth-oauth2-client-secret"
@@ -763,6 +779,7 @@ resource "kubernetes_secret" "auth_oauth2_client_secret" {
 
   data = {
     "client_secret.json" = data.sops_file.auth_oauth2_client_secret_sops.raw
+    "hailctl_client_secret.json" = data.sops_file.hailctl_client_secret_sops.raw
   }
 }
 
diff --git a/infra/gcp/populationgenomics/auth_oauth2_client_secret.enc.json b/infra/gcp/populationgenomics/auth_oauth2_client_secret.enc.json
new file mode 100644
index 00000000000..7b62fea7199
--- /dev/null
+++ b/infra/gcp/populationgenomics/auth_oauth2_client_secret.enc.json
@@ -0,0 +1,36 @@
+{
+	"web": {
+		"client_id": "ENC[AES256_GCM,data:eaAGOdp+oMIi88VQ5G5aE0FIkPmGdPifwGoNKl5IWKZSTDBBn6fSPgcj+1Gnx3JcQcdZUcgokw9ybkc7W3URDg9OGC/is6fQ,iv:I7zdlXunkfdEZ2WlRzkjvpNvuekjVeCMRz6ZP0ay/iQ=,tag:Dr2DcQDJ3/51qvYAkDPsGw==,type:str]",
+		"project_id": "ENC[AES256_GCM,data:HctVX0c7BSCSMtY=,iv:p1GFV+YY1aAGNvr3KIKT5zMCu/RSH5ToxtNdbsPbDCQ=,tag:PAtBTwOIzqGic4vN/e/o/Q==,type:str]",
+		"auth_uri": "ENC[AES256_GCM,data:TUuV3pyK2Vc9E3Ro2yaOTB87sJSDh2FoDM/Ah/fJLXD90tvEJ48kWoc=,iv:80OaGayp0FEoMXXmbXFgPrJ+4iw9xTIcDsXDXBIjMHU=,tag:3NL7x5BxcYTik36nFDw+mw==,type:str]",
+		"token_uri": "ENC[AES256_GCM,data:Npk8MApu9qcfZj/CcNmZqx7DEEfQzS7XXVE98ZTd9cxsyN8=,iv:Fihc8bEk4vUDQgXLw2qxhKkFtA8nYRpvmd1ms8fdGwg=,tag:8qadiwmluCK4X5P4j7vXvg==,type:str]",
+		"auth_provider_x509_cert_url": "ENC[AES256_GCM,data:zvw76ZGs40zl1Z00oqHQojWmKfTH64lkt8Oo/hBJizjQh6PtZd3KwCjv,iv:RVPKL2M0AklucZbqrEFNu5rD5iAGDrj/G+20yiEgIzU=,tag:7SDfG83I1Vp9upLl4rna9w==,type:str]",
+		"client_secret": "ENC[AES256_GCM,data:EfS6wVX9jUIOGhpS9EWoS8HhnS8zzF6D,iv:0d5snPds/pHW+f4OJP2x2AlnlvKqBV7DrKmsgMzymfU=,tag:anBpngwRhIZQYKKXlpv6WA==,type:str]",
+		"redirect_uris": [
+			"ENC[AES256_GCM,data:2kQbbmMEuFJGry9LNIrU+/haBXIQPq7QpEjp/ap1AvBT18e2uCow4CyZ+59uA2VMrRwRQgd3V8NfMw==,iv:ijnINANsRY1szF2pT6Rxq8AIKSfu+wPf2fsp1UzKVPI=,tag:YPWACkUWUSyVEjvbKEk25g==,type:str]",
+			"ENC[AES256_GCM,data:S+B6VnLg/FxsYRBRMb7+jEJdegTdihT//MbG56VsZQ==,iv:tvL2qR+4nASlZykPb8Yx4IusRk76gkGT0HogrVBSdno=,tag:6NY65VlpXmGoEq6wSJzehg==,type:str]",
+			"ENC[AES256_GCM,data:P0oQHc1wCeSGpE4uLzo1b1NyjXD2ISqEOweFwHxAmdrmF1FuSUlyKrOiwIdrXN5kjYgEXZQgdaC81KaidIUCMoy1GTTQeOd78uArNhQzTuiXmwHF6cIebQ==,iv:UUb9zKtfsRoCamezOLsIDh+75hvrhB/Xj9yv0nRzqTM=,tag:eSRbZ6tVFyHn+njWdCl1ZA==,type:str]",
+			"ENC[AES256_GCM,data:McbGtcjaRW+RFI48UmAj1Vgmn3TB7CflO4WEo2uLRqm/2v4AHdwkv+Hx5soCsEsH0Fm8qB06QBXednu/VMWzHtzAfYUgCnd5Q61OI+Kgxpl8T93yWQ==,iv:U3rOxXulKoZp+bwmGWza6iOcuDcgWUWDgZCIikGtSAU=,tag:GwVEFlX2qRHxgFpBZfHrKg==,type:str]",
+			"ENC[AES256_GCM,data:vzGz29rRjeuCMGtDhKcUW0nL78HFXqvD2Qe2WbcOabFxL0Pt/4LR2BKx25ecyjpF8C024pKrS4QNaHeuiOgMRQyIGjaoEBHbfpAEekosUOT8IZY=,iv:5g+7fUVgy8GyL2zmOW8gsov0cskvlCs9FCZFElO44V8=,tag:kjFkbUye6v41NKT4AVPZug==,type:str]",
+			"ENC[AES256_GCM,data:m/zo+RGd4bGXJRtJFyqCnFppmdqEtGXPRto+vkvj8FmfGt8K18heVaCEAtBmdXogok9rmGvPzalWjMkkMm08KxkQ0NL/uetyaqgRtZvoH1ms,iv:XMOmNJWEHzjucp++uduUC0spYlg/kVYB9LSWPXpYU7M=,tag:P/3V9+keQDxV3Y8/efw4dA==,type:str]"
+		]
+	},
+	"sops": {
+		"kms": null,
+		"gcp_kms": [
+			{
+				"resource_id": "projects/hail-295901/locations/global/keyRings/sops/cryptoKeys/sops-key",
+				"created_at": "2022-04-01T03:47:32Z",
+				"enc": "CiQAKYFiUcNvw0DpeI53KNdobbTVVbhR03sz9GlYjm2tHgbgucsSSQAB+Y96sfETf2pJD8vcq5dj2GrGvv/b+YLSBDTH7uBVAqb0d2DnJ29Nukbztf+q6DkLcnOijiMwHLvp0MkTlwVoZjJtjAVTHDk="
+			}
+		],
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": null,
+		"lastmodified": "2022-04-01T03:47:33Z",
+		"mac": "ENC[AES256_GCM,data:IvzhANPGdNY6A9EE9wdxoiPRppggk75In+dUh7QxP25XI0hXe55xPL+ICK3FVko9Dq+IkV0rV5Rpo/vX55gFG6NiJNcBeipOZi1BWN9XBNR8h0bWi99wMz60/1A3fe+52Cb1486xWBsrqxPXMAOW6ajo5OPrfGAi2PSB0DV1yMY=,iv:DPXztjWklw4o6fELV8vXdNUPECgSeLniOTmJDoKSbgs=,tag:CBo2AwmwBy39pCeHFBRt0Q==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.2"
+	}
+}
\ No newline at end of file
diff --git a/infra/gcp/populationgenomics/ci_config.enc.json b/infra/gcp/populationgenomics/ci_config.enc.json
new file mode 100644
index 00000000000..5751f0c2233
--- /dev/null
+++ b/infra/gcp/populationgenomics/ci_config.enc.json
@@ -0,0 +1,36 @@
+{
+	"bucket_location": "ENC[AES256_GCM,data:o9635cNapb0Qg6rrPMDBJ+NjnDs=,iv:P3bODP0g0Kro5ydVULruxD9/wF/DqlC7S491bFIPoKw=,tag:aLhNbe85N/ACHjn6QgTxCQ==,type:str]",
+	"bucket_storage_class": "ENC[AES256_GCM,data:CYofNEahvhc=,iv:3w+H/5cxZ5cZ0S0An+t4Im0QUVW/Uz65MOZdZB2Z9lM=,tag:vZG5lEBg0ZF4jcxO+QM35g==,type:str]",
+	"deploy_steps": [
+		"ENC[AES256_GCM,data:jj0tCUHD2BZy+JF2,iv:xHQFCvG/HwtyQC9PBa9Dpj09nQ49k4RJr5VRan1wiXE=,tag:YmQaBeDC2CQun5N6XRa26Q==,type:str]",
+		"ENC[AES256_GCM,data:Hs1eLUo0fzJD,iv:HY/p+AL9m/RUkt9zx9O8CKm9UKHd8QoVHr/id1ejw+Y=,tag:9g0ddr6qjWHwHHrOx5gtDw==,type:str]"
+	],
+	"github_context": "ENC[AES256_GCM,data:Q1GTJQVZ,iv:DBRg4sEjxSJrx50jrp/8EgiOc72dmWt4aDWaih7+5VY=,tag:JNl0DwXD5sUDGEo7mr/pLw==,type:str]",
+	"github_oauth_token": "ENC[AES256_GCM,data:ynTh1VakYqpfQKpsrnxZCebqy9vrOueHzAhoV+wX6JlM6rgG6F0FOg==,iv:I9iD77AQbPNICVTunZXakB8EeIqi1AAKOi/HFdBR8E0=,tag:aCLHwqk19jAw1+V5Q3HDPQ==,type:str]",
+	"github_user1_oauth_token": "ENC[AES256_GCM,data:zWvr0f/9wa3t7FbRONu3SsqBSINCSOloI/fvgOxMwhF5VJNIbWnMHA==,iv:BEUNsLzBPFMb3VtxLcSxePkk3X6FFpM8f54e/Jrm3Qo=,tag:SFAtEu8TuDKpCQ/oFlQuHw==,type:str]",
+	"watched_branches": [
+		[
+			"ENC[AES256_GCM,data:QqccnarowD2dDaw9cwpYki6iIATkkq4uGDxjcQ==,iv:RAnQ2jvZgaId9yzuJcfYiZcrxBSJgWXeiwuqcmYOM5I=,tag:xWR30+PfkRI24uSnyYyf/w==,type:str]",
+			"ENC[AES256_GCM,data:C4GgIQ==,iv:Mfnx8+YPnHxHuMXRaxXsE9uLLZlPnG3zYg9VduP8f60=,tag:zX+gB+5d/QPoziEZWLKD/w==,type:bool]",
+			"ENC[AES256_GCM,data:Anl1ReQ=,iv:99FxkvU1Yvb91ePta8atxSakzDwh3FguRQoHiKj1LXM=,tag:iq6e8w0d6HprKoG6o4I5hg==,type:bool]"
+		]
+	],
+	"sops": {
+		"kms": null,
+		"gcp_kms": [
+			{
+				"resource_id": "projects/hail-295901/locations/global/keyRings/sops/cryptoKeys/sops-key",
+				"created_at": "2022-04-01T04:48:38Z",
+				"enc": "CiQAKYFiUShRXvolguAYickuKQn5LcEmZiUhX2+AzRbFAGmEilESSQAB+Y96DqCBZwh/Bq0qsC+rF2pkvXXBmCUTrV6d4VyYWcqXrkVtumkqsdNrNh+Unjnyo5zt+M/Ptz1das8Hk70ua2hul2DMI5w="
+			}
+		],
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": null,
+		"lastmodified": "2022-11-27T23:33:47Z",
+		"mac": "ENC[AES256_GCM,data:pgtx65HqUenyn7L3kL2739vcVaa97Htu2AvBfLo0AtZqBiTaH+Y5t+ooJ7MVvzBqxrf6EuPmDq18i1Kj9b4YuoJM4y4mgfGWJ7OgODp4ItPoiiCqyJ7ohMc/kQyBVgaJLvMHvv1J2wH1L15SjOMXrXPIA/9Cqb0FyW2Eask/KgQ=,iv:JUis5/k3DfZlAUefBhUhH3jphgnlFuRUxODBW8wo+H8=,tag:WGTIZd7BYEGjntb1YTacGw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}
\ No newline at end of file
diff --git a/infra/gcp/populationgenomics/global.tfvars b/infra/gcp/populationgenomics/global.tfvars
new file mode 100644
index 00000000000..119f331942a
--- /dev/null
+++ b/infra/gcp/populationgenomics/global.tfvars
@@ -0,0 +1,29 @@
+organization_domain = "populationgenomics.org.au"
+github_organization = "populationgenomics"
+
+# batch_gcp_regions is a JSON array of string, the names of the gcp
+# regions to schedule over in Batch.
+batch_gcp_regions = "[\"australia-southeast1\"]"
+
+gcp_project = "hail-295901"
+gcp_location = "australia-southeast1"
+gcp_region = "australia-southeast1"
+gcp_zone = "australia-southeast1-b"
+domain = "hail.populationgenomics.org.au"
+use_artifact_registry = true
+
+# This is the bucket location that spans the regions you're going to
+# schedule across in Batch. If you are running on one region, it can
+# just be that region. E.g. "US"
+batch_logs_bucket_location = "australia-southeast1"
+
+# The storage class for the batch logs bucket. It should span the
+# batch regions and be compatible with the bucket location.
+batch_logs_bucket_storage_class = "STANDARD"
+
+# Similarly, bucket locations and storage classess are specified 
+# for other services:
+hail_query_bucket_location = "australia-southeast1"
+hail_query_bucket_storage_class = "STANDARD"
+hail_test_gcs_bucket_location = "australia-southeast1"
+hail_test_gcs_bucket_storage_class = "REGIONAL"
diff --git a/infra/gcp/populationgenomics/hailctl_client_secret.enc.json b/infra/gcp/populationgenomics/hailctl_client_secret.enc.json
new file mode 100644
index 00000000000..8a658cf9706
--- /dev/null
+++ b/infra/gcp/populationgenomics/hailctl_client_secret.enc.json
@@ -0,0 +1,31 @@
+{
+	"installed": {
+		"client_id": "ENC[AES256_GCM,data:jvv+BGWBF8m9Plqk1vMG6y/EMg1N8d3Qv9jqq21LPT0gOyLZJzB8/P1cMeyBHbVGmSF4xOz+WLLnaW8o3fiLUm7ZEnKPe1B/,iv:Z68rQKWFpKaTOt/oqb8/q/5vMxd7VkAqYgLBYEkQ9jA=,tag:58ZCP7qO/RHft9VulRVrRw==,type:str]",
+		"project_id": "ENC[AES256_GCM,data:32w0DYZsXXsWsCo=,iv:U1aPT7WRXd+xA87lRmDgPn8RPXTs56IrSHCAkd69J+4=,tag:++IAC5y5TX+sC2FqAEa4bQ==,type:str]",
+		"auth_uri": "ENC[AES256_GCM,data:fRGyEuJZcGKKPS3vbO51YNeNCA8wOrxSnQDjYIv4uJ0kRo53QCoYpl4=,iv:dc+SbxsrXaGgXvbWLu5843/djnhsY2xMJZ7tuZXE8RQ=,tag:lpoYCGbOgpDOjlfIIHlJYw==,type:str]",
+		"token_uri": "ENC[AES256_GCM,data:QxJu8dK2LuJ71XqZbO4TAeBg5+pORZseEJ7gInL+qE4k70I=,iv:0qCLZfAUn1IUkq2HM9xgYIoK0zImVskxjwZj8sc3pN0=,tag:mbP/OGuWfY0i+YZrgqhXLw==,type:str]",
+		"auth_provider_x509_cert_url": "ENC[AES256_GCM,data:us40NR1ptDdC0p1ZJT0dxUc10BzVuuX4DjgZMvOgLXKRu17OkebDKIe0,iv:CJv6YtA64J906d2X9kE9GcoA2yF21C7OfIcKNLBUtJE=,tag:FURZ+nMqZqvwjiTF4aT5kA==,type:str]",
+		"client_secret": "ENC[AES256_GCM,data:wynrlaG6Nd8zqzhjsoEriOsqkCPeGWSlfXULT77ZtPwB/3c=,iv:rSILcZlyz089d52P9+hO3KCC27rsn2Vuh698N5qaqXA=,tag:KLoer+ludAjq3nvwyckjrw==,type:str]",
+		"redirect_uris": [
+			"ENC[AES256_GCM,data:CFtaNoObuS7+ozCZwCx4iw==,iv:sbeQtyRq1LO3z+BBgEb80i/KeEh/wBGAbDCLK/4FuhQ=,tag:rMW2+1Ng3IUK064tGh+D9A==,type:str]"
+		]
+	},
+	"sops": {
+		"kms": null,
+		"gcp_kms": [
+			{
+				"resource_id": "projects/hail-295901/locations/global/keyRings/sops/cryptoKeys/sops-key",
+				"created_at": "2024-01-05T03:40:24Z",
+				"enc": "CiQAKYFiUZrtZBntWFwLSIsHT8x6Y6oEXvxURKNGHzu0duxKHGgSSQAB+Y96vjlNZ0TMMhoqEib4x80hNBFuoXyQiBVzdcxltQ3G7V/EPQQhKM6gLXyA49xwygeMc5UcSOjFLF9VYgiqzC/xI5Wjpng="
+			}
+		],
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": null,
+		"lastmodified": "2024-01-05T03:40:25Z",
+		"mac": "ENC[AES256_GCM,data:7a+IWFDuqU9ZgEvKaF79qbctQSOGxFNZ/Syn/Z5xEe7bj45BvAqWtQrUUZj6vmOC8OxG3p1RTJ7YF5K8v5/0qpuGop5xv5XrMgoC4OW9Fy0XXDpinsTQmBhu2JELG3fQAceDUQqUYoJaMt+Cvni+y/YFHOCY0WuE9N6npW9LXF4=,iv:McqrzKl8AjpqZpe/+RGtwrX6GkRozTQ6BzUG7qq637I=,tag:hdE4vIOQnmicvQVkoycB7Q==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}
\ No newline at end of file
diff --git a/infra/gcp/populationgenomics/terraform_sa_key.enc.json b/infra/gcp/populationgenomics/terraform_sa_key.enc.json
new file mode 100644
index 00000000000..31526999278
--- /dev/null
+++ b/infra/gcp/populationgenomics/terraform_sa_key.enc.json
@@ -0,0 +1,30 @@
+{
+	"type": "ENC[AES256_GCM,data:tFYK1vfHcr26TQFneTRY,iv:usBwiNPAYJeVyYukEigA+gQR62kEMFVUVtMbxhvBtL4=,tag:le15hVNAv7ydw08plx5FvQ==,type:str]",
+	"project_id": "ENC[AES256_GCM,data:Bcc3VNlRgPuMmVA=,iv:NwMv2fMhi9eAmfLlhSeRvPWClnfWlxN3seNtTD8EDRg=,tag:crij5ZMRXhfuSo1+Fi8R0Q==,type:str]",
+	"private_key_id": "ENC[AES256_GCM,data:++bmmwQv5V7elOB3YpeBE3RK20KKV7f+/zxp8dzV1li2FyWQtIQsnw==,iv:eYV0AOH/NQyWLZRvYWnU9A8YdwHwTaM39TDFS6pl5ME=,tag:uoJzFjNR8lkVBd1hrB+m7Q==,type:str]",
+	"private_key": "ENC[AES256_GCM,data:2xcHP4yDSruXl1MWi8+SL/FbJDWyd86As03i3tBc17/ERpm4KsaznSmCxfNXwzpuQ8B1v+c0hvt5yrFFxhYL9U4+t/BqKMvZGPYuAsHFfGmeMLjBIAy60LVlVNcpoiHo7q79x5OYIcjz+yhjSFGRZLqpfbztXF+GO1jBAG2A3r+U8bwPYaFR7+Hle1P5qeThzvpijFqIzCRns+CoXsuINMUh7dfMELCojORHQNri9yVoYsDtEEZafmdm2B9ILyLIK/IQtqEMjEpMpdj/UKzjDF0pCbQ1PI+dpVgRx6UrDQV7vfmkAXlHwMndf0N31Ap0qqW91RjBiZmcEF7w+GsIbhMOvriULxE7puBzTsSeLsbkketH4FnaDbYXh/bjLMpx81GeYf1PnlqJfcJSZPLN5q+Gnnr5AKZbWgBxFEr1l+kT0tZyRS4bfjTLNcU61VIvlcFfPdPWh50Fuw6+eV/xtYZ12SKAumSqiRJxCAvKm9WXWI2D0R7hSPcLRhN5vNsSK2lN5XvxeNwbcoJqzU36viKpE6/PVWlzGeSx4wjlPS/DKOpOfDvB9kZKhxCK+sfvftUxMUePsi7YyfE+6oVDv3tqxz8wuau9ubSU5YhvosAUeaPsLjkDJRGQnpZ20i38GAXEVxFcdc3aRTv7PxFGbuEQWybWmK0R98lNbmafNS+Kf60xgr0lgTeE9IlFvjuAvp4dpO1oCcOhdHyKPv5ZEmTfAQgmko9UxUqGESQY4j6O81SzWzP+UNXQC/itmRmzUFGleBFwKfHAPjBVvLZ9N8qJ6VP3lQ+umQK0V913CiOrtMecESmMroW1GPPa+CU9fbu/vOv9ZUcehVYFclqBcXx2i2LdgFtAgfv5SEPYndZBRMiIw0Iv8KxE90m2bXBf516z2lpRqPQ8kHAspKgHHb9Cv05Yp2/V9d6lSNUPJlHx356oYrCOfkvfdCeT/eeDGAriADQrBmUBw6hJG8EyX8XD794Mrhhx1Dc5x7t/jXBNeXXInU3SvLPCwyPPXecKTInBw6d5BoiarnFHx1JbWhoaxOklNfYrMzelkITJptcO45W//50CszFs7aHxCWUTgdAjS+CC7CAaSYdZgD0Sa7K1NUmC+EnLhdXLs1ICXH/KN++ZMTw3trZJGjq+SFQYpsiMd+PYehl6QbsgKF//X9wBbWYpC3ESvhECMx633ZliYVC54IcbUz4sJw4SMp75h1kSFJ5Q7/0XitfjNmVVVLpHrq9k8kV40f616cE5BZQpYXmiVQ1A/pf/fZSr4rt9guGH2imnQRsGxsbqZyw8zyUDbQ779a8ZR1ysfvyz0B121o103Xws+VRjdJc56R/VpAFiw+9tX/fLRa+6Mtj8m82T16JLUyc8taDATaHjxib/gCESwF3iIBSxKP6hWsM8llyPX3q5GPjMJNAkyJDbRfx/IA1TgRBgoNnd/Dm2/uUDLKwQ48qZAUGJ5CCHXdOEVga+R4Nx3cR6cwLxVViw1dQiXZVkGc+hQInyC/zjoZMRIuJNsj1a23F83wSK/ezG2aEDZZP6kYXBj9s5lPdbL/rFHuCW4UhqbjIzLpLtlt+UPCenaDGXc73IXwON9InjmGdB32qOCQJw1xWJOiwsJUnai84Pzuzs4tfDJhY0pRLVijfX5bzKkGtJcsu5UqlXVq5ikhrV8KCVyrgMO0ohZmFgWMO5JZl9ruG+Etw2P1fNWWcL7rrUzDVYsI8bk3nAN2tPU2eFCkGayuviuUYBJrVxAyXRH4vyQcksDyY9+yZlUBp75PDdA4zwvNlBUODNflJB6DteGscHxDsr6RldRLxbAFJ8HKo60HD9vSqgJZWcbqvozSeHa4aFALkrWgIOEjqtySC6CoTInYaNsQl6obdm4B3Lc9hC1w3muj1Vzl31jiq/i2bC1Hpc4b7nlY61ipFe/V7US1GiqOdFOugN6QLajXkCE9b8x59IKQTpLEDVU+eVN5V2CtQscFLFfWWfIHE1+m7aI+dNtaPfrOp1MNRj/FBCHWsC3A9P8iwGxUIt1jYIyMwtXkMJiaP2UaUgxpdCagvSneSFhYn55/zdKpWgoIWE/Es7ccomli7c03p2r2j8AcmoepdiyaqSxKHBQT6aznJnAMeGnxvDbxGZdfBqJDguEMLHh07HzXQ95h9tC3S/1xIdkYBsxWFtFcMK3YWdqd0RUssnXDfk7ADj0yoPGL8pwZk0rFbn4GXO9ADs1F1uMgjoKtkR5NxWfbBiIHSbqP8BwjM9aNoQoOSDW7j1XoNpQPU3,iv:f88xs6oXcZIKdSnt1Gl8N+nGrMlwVafTCQPxYFcDcGk=,tag:OILo8O7lhj/P0zZyEhkiFw==,type:str]",
+	"client_email": "ENC[AES256_GCM,data:K6WKQWrsEp4tgFAFv7rqwof0jxuoeaZna6NyAtUmlDEKcXtZF6eqXTo/v4dG,iv:1f5uXU6ttpgriAT5HAh4qcOQE75DMvN5+6+2/K3XLhc=,tag:/ezeER3XQG26jQB/qvJRIg==,type:str]",
+	"client_id": "ENC[AES256_GCM,data:P3stjpos9BUl3OWjPwEGLvBwG83f,iv:Xnzo8DIMA/WwQOSttYJEpAV2aJxMCmhVMWlXmjJu7Pc=,tag:YhshTtXEs73WVERmkyngxw==,type:str]",
+	"auth_uri": "ENC[AES256_GCM,data:Wa0dViUcTMjmwnHIk7nbyfJi3XNE0Xy56ZAE41lkYKOCwn5LzJwep60=,iv:GPiqAdsjqaDsc/MM+Ahpjx7/UUax5qqYKf4oRt1TQgw=,tag:i+nLp19XSMip7NLnnRDRLg==,type:str]",
+	"token_uri": "ENC[AES256_GCM,data:4GAgHNrQS9M1x6hZIl4cnQOG9r3vE3QwY2Y7OWpZgGieTuM=,iv:/arD9sO1MdO4J4tsxm1E3WdnPts+J0gFu/ETtyZtW+U=,tag:VRR3+1PNH0gJSZ79f0upGQ==,type:str]",
+	"auth_provider_x509_cert_url": "ENC[AES256_GCM,data:ZDwxJ2l7rMIo+L0hRUt4ymZRs4F0OKo4mRuseNNf0PeHkk7hMguobd3g,iv:pzWKW8dUeHSsQInAXOFZR9CknUIt+cT3tKmfVMGGduo=,tag:fuo7uxpYE78i+l6SY4oKiQ==,type:str]",
+	"client_x509_cert_url": "ENC[AES256_GCM,data:pwR4evh+15goLhuW4ASO0KoHcRm/c2Rd8wkWsQwsHUDk9Y5D/VRCGjpACG9MDLMxah0a9DtBjGGJcxGed/O2xp1RRj8OLB7SK8/CKRwBCszGAXEMIaOyh1XOqsrAQSFOlQ==,iv:c88tLvyZS0FmfH93We3X3GxflL59rBPvq4VD7I4fie4=,tag:mw48WEOuGTwfM5/S4Qgd1Q==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": [
+			{
+				"resource_id": "projects/hail-295901/locations/global/keyRings/sops/cryptoKeys/sops-key",
+				"created_at": "2022-04-01T04:25:20Z",
+				"enc": "CiQAKYFiUaz5U7Yb9TlP+OYVBdFGHXhyEWcM1/Ux2oGcsjxqvaISSQAB+Y96XZUCqzsHDiJuL6xpSZUtUH1HrQa3JaLuz11cS9L4WtvBoclBUhOSjXBifjoEdDlwaxT/2+mVqPNjTfRvWhK0hS+7Lh0="
+			}
+		],
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": null,
+		"lastmodified": "2022-04-01T04:25:21Z",
+		"mac": "ENC[AES256_GCM,data:fN1JUaOvmgMmjeDYooUAsgv81QAeB8yQ22aLMJH6o49DPCyXBaoXCgoCySpRNxtWUx99qmgd0eIi7h65Q3i96XjBW+Dk1AzK5Kk0IsjvWHoA1ifADBP78kkCsiIkt2NegBbNsazsxGdfzQ2j0ILKijWqFHZo/nq9ywT6U9hty5Q=,iv:efgkwvrsehFt3qNN7Hq5fnyymPj7IECXbYnhUad3pNI=,tag:ldr9MTmZt/RewPPgIDqeUw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.2"
+	}
+}
\ No newline at end of file
diff --git a/letsencrypt/subdomains.txt b/letsencrypt/subdomains.txt
index 94633e98b05..f83545da776 100644
--- a/letsencrypt/subdomains.txt
+++ b/letsencrypt/subdomains.txt
@@ -1,12 +1,4 @@
 ci
-www
 batch
 batch-driver
-blog
-monitoring
 auth
-ukbb-rg
-guide-analysis
-grafana
-prometheus
-hello
diff --git a/query/query/query.py b/query/query/query.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/router-resolver/Makefile b/router-resolver/Makefile
new file mode 100644
index 00000000000..499a106ebdd
--- /dev/null
+++ b/router-resolver/Makefile
@@ -0,0 +1,31 @@
+include ../config.mk
+
+ROUTER_RESOLVER_LATEST = $(DOCKER_PREFIX)/router-resolver:latest
+ROUTER_RESOLVER_IMAGE = $(DOCKER_PREFIX)/router-resolver:$(shell docker images -q --no-trunc router-resolver:latest | sed -e 's,[^:]*:,,')
+
+EXTRA_PYTHONPATH := ../hail/python:../gear
+PYTHON := PYTHONPATH=$${PYTHONPATH:+$${PYTHONPATH}:}$(EXTRA_PYTHONPATH) python3
+
+.PHONY: check
+check:
+	$(PYTHON) -m flake8 router_resolver
+	$(PYTHON) -m pylint --rcfile ../pylintrc router_resolver --score=n
+
+.PHONY: build
+build:
+	$(MAKE) -C ../docker build
+	-docker pull $(ROUTER_RESOLVER_LATEST)
+	python3 ../ci/jinja2_render.py '{"service_base_image":{"image":"service-base"}}' Dockerfile Dockerfile.out
+	docker build -f Dockerfile.out -t router-resolver --cache-from router-resolver,$(ROUTER_RESOLVER_LATEST),service-base ..
+
+.PHONY: push
+push: build
+	docker tag router-resolver $(ROUTER_RESOLVER_LATEST)
+	docker push $(ROUTER_RESOLVER_LATEST)
+	docker tag router-resolver $(ROUTER_RESOLVER_IMAGE)
+	docker push $(ROUTER_RESOLVER_IMAGE)
+
+.PHONY: deploy
+deploy: push
+	python3 ../ci/jinja2_render.py '{"code":{"sha":"$(shell git rev-parse --short=12 HEAD)"},"deploy":$(DEPLOY),"router_resolver_image":{"image":"$(ROUTER_RESOLVER_IMAGE)"},"global":{"domain":"$(DOMAIN)"}}' deployment.yaml deployment.yaml.out
+	kubectl -n default apply -f deployment.yaml.out
diff --git a/router/Makefile b/router/Makefile
new file mode 100644
index 00000000000..2abddc55ba7
--- /dev/null
+++ b/router/Makefile
@@ -0,0 +1,28 @@
+include ../config.mk
+
+ROUTER_LATEST = $(DOCKER_PREFIX)/router:latest
+ROUTER_IMAGE = $(DOCKER_PREFIX)/router:$(shell docker images -q --no-trunc router | sed -e 's,[^:]*:,,')
+
+.PHONY: build
+build:
+	$(MAKE) -C ../docker hail-ubuntu
+	-docker pull $(ROUTER_LATEST)
+	python3 ../ci/jinja2_render.py '{"hail_ubuntu_image":{"image":"hail-ubuntu"}}' Dockerfile Dockerfile.out
+	docker build -f Dockerfile.out -t router --cache-from router,$(ROUTER_LATEST),hail-ubuntu .
+
+.PHONY: push
+push: build
+	docker tag router $(ROUTER_LATEST)
+	docker push $(ROUTER_LATEST)
+	docker tag router $(ROUTER_IMAGE)
+	docker push $(ROUTER_IMAGE)
+
+.PHONY: deploy
+deploy: push
+	! [ -z $(NAMESPACE) ]  # call this like: make deploy NAMESPACE=default
+	python3 ../ci/jinja2_render.py '{"code":{"sha":"$(shell git rev-parse --short=12 HEAD)"},"deploy":$(DEPLOY),"router_image":{"image":"$(ROUTER_IMAGE)"},"default_ns":{"name":"$(NAMESPACE)"},"global":{"domain":"$(DOMAIN)"}}' deployment.yaml deployment.yaml.out
+	kubectl -n $(NAMESPACE) apply -f deployment.yaml.out
+
+.PHONY: clean
+clean:
+	rm -rf deployment.yaml
diff --git a/web_common/web_common/styles/main.scss b/web_common/web_common/styles/main.scss
index 523bed67fbe..c11d482bd85 100644
--- a/web_common/web_common/styles/main.scss
+++ b/web_common/web_common/styles/main.scss
@@ -248,8 +248,23 @@ a {
     }
 
     tr {
-        &:nth-of-type(even) {
-            background-color: #f0f0f0;
+        &:nth-of-type(7n+1) {
+            background-color: #fff4f4;
+        }
+        &:nth-of-type(7n+2) {
+            background-color: #fff9f1;
+        }
+        &:nth-of-type(7n+3) {
+            background-color: #fdfdf1;
+        }
+        &:nth-of-type(7n+4) {
+            background-color: #f4fff4;
+        }
+        &:nth-of-type(7n+5) {
+            background-color: #f2f4ff;
+        }
+        &:nth-of-type(7n+6) {
+            background-color: #fff6ff;
         }
 
         td.data-table-bad {
diff --git a/web_common/web_common/templates/header.html b/web_common/web_common/templates/header.html
index 690b67743b3..dc5db468830 100644
--- a/web_common/web_common/templates/header.html
+++ b/web_common/web_common/templates/header.html
@@ -44,11 +44,6 @@
   <div class="header-dropdown">
     <div class="header-dropdown-item-margin">
       <a href="{{ ci_base_url }}" class="header-dropdown-link">CI</a>
-      <div class="header-dropdown-menu">
-        <div class="ci-caret header-dropdown-menu-caret"></div>
-        <a class="header-dropdown-menu-link" href="{{ ci_base_url }}/me">Me</a>
-        <a class="header-dropdown-menu-link" href="{{ ci_base_url }}/namespaces">Namespaces</a>
-      </div>
     </div>
   </div>
   {% endif %}