diff --git a/deploy/argocd_password.py b/deploy/argocd_password.py
new file mode 100755
index 0000000..baf3071
--- /dev/null
+++ b/deploy/argocd_password.py
@@ -0,0 +1,13 @@
+#!/usr/bin/env python3
+
+import bcrypt
+import random
+import string
+
+chars_fixed = string.ascii_letters + string.digits
+passwd = "".join(random.choice(chars_fixed) for x in range(15))
+
+salt = bcrypt.gensalt()
+hashed = bcrypt.hashpw(passwd.encode('utf-8'), salt)
+
+print("{}:{}".format(passwd, hashed.decode('utf-8')))
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index bab1380..37bc8ab 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -1,8 +1,19 @@
 #!/bin/bash
-set -ex
+set -e
 
 DEPLOY_DIR=$( dirname $( realpath $0 ))
 
+# Waits for max 300s and retries
+function wait_for() {
+  local TRIES=0
+  while true; do
+    $@ && break
+    [ $TRIES -eq 100 ] && return 1
+    let TRIES=$TRIES+1
+		sleep 3
+  done
+}
+
 helm repo add kubezero https://zero-down-time.github.io/kubezero
 helm repo update
 
@@ -13,6 +24,49 @@ if [ $rc -eq 0 ]; then
   helm upgrade -n argocd kubezero kubezero/kubezero-argo-cd -f generated-values.yaml
 else
   # During bootstrap we first generate a minimal values.yaml to prevent various deadlocks
-  helm template $DEPLOY_DIR -f values.yaml -f kubezero.yaml --set=bootstrap=true > generated-values.yaml
+
+  # Generate ArgoCD password if not in values.yaml yet and add it
+  grep -q argocdServerAdminPassword values.yaml && rc=$? || rc=$?
+  if [ $rc -ne 0 ]; then
+    _argo_date="$(date -u --iso-8601=seconds)"
+    _argo_passwd="$($DEPLOY_DIR/argocd_password.py)"
+
+    cat <<EOF >> values.yaml
+  configs:
+    secret:
+      # ArgoCD password: ${_argo_passwd%%:*} Please move to secure location !
+      argocdServerAdminPassword: "${_argo_passwd##*:}"
+      argocdServerAdminPasswordMtime: "$_argo_date"
+EOF
+  fi
+
+  helm template $DEPLOY_DIR -f values.yaml -f cloudbender.yaml --set bootstrap=true > generated-values.yaml
+
+  # Deploy initial argo-cd
   helm install -n argocd kubezero kubezero/kubezero-argo-cd --create-namespace -f generated-values.yaml
+
+  # Wait for argocd-server to be running
+  kubectl rollout status deployment -n argocd kubezero-argocd-server
+
+  # Now wait for cert-manager to be bootstrapped
+  echo "Waiting for cert-manager to be deployed..."
+  wait_for kubectl get deployment -n cert-manager cert-manager-webhook 2>/dev/null 1>&2
+  kubectl rollout status deployment -n cert-manager cert-manager-webhook
+
+  # Now lets get kiam and cert-manager to work as they depend on each other, keep advanced options still disabled though
+  # - istio, prometheus
+  helm template $DEPLOY_DIR -f values.yaml -f cloudbender.yaml --set istio.enabled=false --set prometheus.enabled=false > generated-values.yaml
+  helm upgrade -n argocd kubezero kubezero/kubezero-argo-cd -f generated-values.yaml
+
+	exit 0
+  # Todo: Now we need to wait till all is synced and healthy ... argocd cli or kubectl ?
+  # Wait for aws-ebs or kiam to be all ready, or all pods running ?
+
+  # Todo: 
+  # - integrate Istio
+  # - integrate Prometheus-Grafana
+
+  # Finally we could enable the actual config and deploy all
+  helm template $DEPLOY_DIR -f values.yaml -f cloudbender.yaml > generated-values.yaml
+  helm upgrade -n argocd kubezero kubezero/kubezero-argo-cd -f generated-values.yaml
 fi
diff --git a/deploy/templates/values.yaml b/deploy/templates/values.yaml
index 800fee4..30322e7 100644
--- a/deploy/templates/values.yaml
+++ b/deploy/templates/values.yaml
@@ -1,10 +1,17 @@
 kubezero:
+  {{- if .Values.global }}
+  globals:
+    {{- toYaml .Values.global | nindent 4 }}
+  {{- end }}
   calico:
     enabled: {{ .Values.calico.enabled  }}
   cert-manager:
     enabled: {{ index .Values "cert-manager" "enabled" }}
-{{- if not .Values.bootstrap }}
     values:
+{{- if .Values.bootstrap }}
+      localCA:
+        enabled: false 
+{{- else }}
       {{- if .Values.aws }}
       cert-manager:
         podAnnotations:
@@ -16,7 +23,10 @@ kubezero:
         email: {{ index .Values "cert-manager" "email" }}
         solvers:
           - selector:
-              dnsZones: {{ index .Values "cert-manager" "domains" }}
+              dnsZones:
+              {{- with index .Values "cert-manager" "dnsZones" }}
+              {{- . | toYaml | nindent 14 }}
+              {{- end }}
             dns01:
               {{- if .Values.aws }}
               route53:
diff --git a/scripts/publish.sh b/scripts/publish.sh
index d94bf44..42debb8 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -17,8 +17,6 @@ helm repo add uswitch https://uswitch.github.io/kiam-helm-charts/charts/
 
 for dir in $(find $SRCROOT/charts -mindepth 1 -maxdepth 1 -type d);
 do
-    # rm -rf $dir/charts $dir/Chart.lock
-
     name=$(basename $dir)
 
     if [ $(helm dep list $dir 2>/dev/null| wc -l) -gt 1 ]