diff --git a/charts/adminer/values.yaml.gotmpl b/charts/adminer/values.yaml.gotmpl
index 263d28c9..1e542426 100644
--- a/charts/adminer/values.yaml.gotmpl
+++ b/charts/adminer/values.yaml.gotmpl
@@ -101,6 +101,7 @@ volumeMounts: []
 #   mountPath: "/etc/foo"
 #   readOnly: true
 
-nodeSelector: {}
+nodeSelector:
+  ops: "true"
 
 tolerations: []
diff --git a/charts/cert-manager/values.common.yaml.gotmpl b/charts/cert-manager/values.common.yaml.gotmpl
index 0857e61b..94c3b6d5 100644
--- a/charts/cert-manager/values.common.yaml.gotmpl
+++ b/charts/cert-manager/values.common.yaml.gotmpl
@@ -1,3 +1,6 @@
 crds:
   enabled: true
   keep: true
+
+nodeSelector:
+  ops: "true"
diff --git a/charts/simcore-charts/resource-usage-tracker/values.yaml.gotmpl b/charts/simcore-charts/resource-usage-tracker/values.yaml.gotmpl
index fe8c54db..23e1f01c 100644
--- a/charts/simcore-charts/resource-usage-tracker/values.yaml.gotmpl
+++ b/charts/simcore-charts/resource-usage-tracker/values.yaml.gotmpl
@@ -91,7 +91,8 @@ volumeMounts: []
 #   mountPath: "/etc/foo"
 #   readOnly: true
 
-nodeSelector: {}
+nodeSelector:
+  simcore: "true"
 
 tolerations: []
 
diff --git a/charts/traefik/values.common.yaml.gotmpl b/charts/traefik/values.common.yaml.gotmpl
index c19616d3..a40c8cc7 100644
--- a/charts/traefik/values.common.yaml.gotmpl
+++ b/charts/traefik/values.common.yaml.gotmpl
@@ -1,6 +1,9 @@
 additionalArguments:
   - "--api.insecure=true"
 
+deployment:
+  kind: DaemonSet
+
 ingressRoute:
   dashboard:
     enabled: false
@@ -19,3 +22,16 @@ ports:
     nodePort: 32080
   websecure:
     nodePort: 32443
+
+nodeSelector:
+  node-role.kubernetes.io/control-plane: "" # in some cases may require tolerations
+
+affinity:  # https://github.com/traefik/traefik-helm-chart/blob/v28.2.0/traefik/values.yaml#L838
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            # https://stackoverflow.com/a/51326166/12124525
+            app.kubernetes.io/name: '{{`{{ template "traefik.name" . }}`}}'
+            app.kubernetes.io/instance: '{{ .Release.Name }}'
+        topologyKey: kubernetes.io/hostname