diff --git a/Cargo.lock b/Cargo.lock
index d470f26..e79d7ac 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -17,6 +17,16 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
 [[package]]
 name = "ahash"
 version = "0.7.8"
@@ -142,7 +152,7 @@ dependencies = [
  "futures",
  "http",
  "memchr",
- "nkeys",
+ "nkeys 0.3.2",
  "nuid 0.5.0",
  "once_cell",
  "rand",
@@ -401,6 +411,17 @@ dependencies = [
  "windows-targets 0.52.0",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+ "zeroize",
+]
+
 [[package]]
 name = "clap"
 version = "4.4.6"
@@ -546,9 +567,39 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
+ "rand_core",
  "typenum",
 ]
 
+[[package]]
+name = "crypto_box"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16182b4f39a82ec8a6851155cc4c0cda3065bb1db33651726a29e1951de0f009"
+dependencies = [
+ "aead",
+ "crypto_secretbox",
+ "curve25519-dalek",
+ "salsa20",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto_secretbox"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d6cf87adf719ddf43a805e92c6870a531aedda35ff640442cbaf8674e141e1"
+dependencies = [
+ "aead",
+ "cipher",
+ "generic-array",
+ "poly1305",
+ "salsa20",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "ctrlc"
 version = "3.4.1"
@@ -573,6 +624,7 @@ dependencies = [
  "platforms",
  "rustc_version",
  "subtle",
+ "zeroize",
 ]
 
 [[package]]
@@ -873,6 +925,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
+ "zeroize",
 ]
 
 [[package]]
@@ -1196,6 +1249,15 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "instant"
 version = "0.1.12"
@@ -1554,6 +1616,22 @@ dependencies = [
  "signatory",
 ]
 
+[[package]]
+name = "nkeys"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2de02c883c178998da8d0c9816a88ef7ef5c58314dd1585c97a4a5679f3ab337"
+dependencies = [
+ "crypto_box",
+ "data-encoding",
+ "ed25519",
+ "ed25519-dalek",
+ "getrandom",
+ "log",
+ "rand",
+ "signatory",
+]
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -1633,6 +1711,12 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-integer"
 version = "0.1.45"
@@ -1736,6 +1820,12 @@ version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
 [[package]]
 name = "openssl-probe"
 version = "0.1.5"
@@ -1992,6 +2082,17 @@ version = "3.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4503fa043bf02cee09a9582e9554b4c6403b2ef55e4612e96561d294419429f8"
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -2347,6 +2448,15 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
 
+[[package]]
+name = "salsa20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.22"
@@ -2792,12 +2902,13 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.30"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4a34ab300f2dee6e562c10a046fc05e358b29f9bf92277f30c3c8d82275f6f5"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
+ "num-conv",
  "powerfmt",
  "serde",
  "time-core",
@@ -2812,10 +2923,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.15"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 
@@ -3200,6 +3312,16 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
 
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
 [[package]]
 name = "unsafe-libyaml"
 version = "0.2.11"
@@ -3292,9 +3414,9 @@ checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "wadm"
-version = "0.12.2"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d20c671aabb8fee1d7a688a81be4ebe14cbc4ae3a01db5dd62202ad39538fa5"
+checksum = "40216dc6034c5e71bf773cea191e13581def996d21acf99fcc9347cc254b0490"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -3307,7 +3429,7 @@ dependencies = [
  "indexmap 2.0.2",
  "jsonschema",
  "lazy_static",
- "nkeys",
+ "nkeys 0.3.2",
  "rand",
  "regex",
  "semver",
@@ -3323,19 +3445,20 @@ dependencies = [
  "uuid",
  "wadm-types",
  "wasmcloud-control-interface",
+ "wasmcloud-secrets-types",
 ]
 
 [[package]]
 name = "wadm-client"
-version = "0.1.2"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "422db00d06cf461d6410396dd5a2653bcf21bccb883659f39173756b91f3f477"
+checksum = "4aaf51fde61578275a9d7f19b7732219162c279dc76f02e2779a5e11beb33240"
 dependencies = [
  "anyhow",
  "async-nats",
  "bytes",
- "nkeys",
- "once_cell",
+ "futures",
+ "nkeys 0.3.2",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -3348,9 +3471,9 @@ dependencies = [
 
 [[package]]
 name = "wadm-types"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af535df65c0387b6a8ef521aca58a239af817f03ebf676f91e982b9b919bc513"
+checksum = "00e7f30261740ec9da4d038cf719032d4bc00437b3e0252e258d0308d44fb576"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -3359,13 +3482,13 @@ dependencies = [
  "bytes",
  "chrono",
  "cloudevents-sdk",
- "futures",
  "indexmap 2.0.2",
  "jsonschema",
  "lazy_static",
- "nkeys",
+ "nkeys 0.3.2",
  "rand",
  "regex",
+ "schemars",
  "semver",
  "serde",
  "serde_json",
@@ -3376,8 +3499,10 @@ dependencies = [
  "tracing",
  "tracing-futures",
  "ulid",
+ "utoipa",
  "uuid",
  "wasmcloud-control-interface",
+ "wasmcloud-secrets-types",
 ]
 
 [[package]]
@@ -3398,14 +3523,32 @@ dependencies = [
  "data-encoding",
  "humantime",
  "log",
- "nkeys",
+ "nkeys 0.3.2",
  "nuid 0.4.1",
  "ring 0.17.5",
  "serde",
  "serde_json",
- "wasm-encoder",
+ "wasm-encoder 0.41.2",
  "wasm-gen",
- "wasmparser",
+ "wasmparser 0.121.2",
+]
+
+[[package]]
+name = "wascap"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d394c2c59661bff13bea8bd7c8bf30618bafa671ef9f408ae9c3aa71ede5bb0"
+dependencies = [
+ "data-encoding",
+ "humantime",
+ "nkeys 0.4.3",
+ "nuid 0.4.1",
+ "ring 0.17.5",
+ "serde",
+ "serde_json",
+ "wasm-encoder 0.208.1",
+ "wasm-gen",
+ "wasmparser 0.202.0",
 ]
 
 [[package]]
@@ -3489,6 +3632,15 @@ dependencies = [
  "leb128",
 ]
 
+[[package]]
+name = "wasm-encoder"
+version = "0.208.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6425e84e42f7f558478e40ecc2287912cb319f2ca68e5c0bb93c61d4fc63fa17"
+dependencies = [
+ "leb128",
+]
+
 [[package]]
 name = "wasm-gen"
 version = "0.1.4"
@@ -3547,7 +3699,7 @@ dependencies = [
  "bytes",
  "futures",
  "hex",
- "nkeys",
+ "nkeys 0.3.2",
  "once_cell",
  "rustls 0.23.4",
  "serde",
@@ -3558,14 +3710,14 @@ dependencies = [
  "tracing",
  "ulid",
  "uuid",
- "wascap",
+ "wascap 0.13.0",
  "wrpc-transport",
  "wrpc-transport-nats",
 ]
 
 [[package]]
 name = "wasmcloud-operator"
-version = "0.3.1"
+version = "0.4.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -3605,7 +3757,7 @@ dependencies = [
 
 [[package]]
 name = "wasmcloud-operator-types"
-version = "0.1.6"
+version = "0.1.7"
 dependencies = [
  "k8s-openapi",
  "kube",
@@ -3614,6 +3766,22 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "wasmcloud-secrets-types"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e141cc3ac1fd9b71ec0813796e0a40767afea090d6395fa2b82abca9c882426"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "bytes",
+ "nkeys 0.4.3",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "wascap 0.15.0",
+]
+
 [[package]]
 name = "wasmparser"
 version = "0.121.2"
@@ -3625,6 +3793,17 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "wasmparser"
+version = "0.202.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6998515d3cf3f8b980ef7c11b29a9b1017d4cf86b99ae93b546992df9931413"
+dependencies = [
+ "bitflags 2.4.1",
+ "indexmap 2.0.2",
+ "semver",
+]
+
 [[package]]
 name = "web-sys"
 version = "0.3.64"
diff --git a/Cargo.toml b/Cargo.toml
index 5264255..4798341 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmcloud-operator"
-version = "0.3.1"
+version = "0.4.0"
 edition = "2021"
 
 [[bin]]
@@ -94,9 +94,9 @@ tracing-opentelemetry = "0.22"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 utoipa = { version = "4.1", features = ["axum_extras"] }
 uuid = { version = "1", features = ["v5"] }
-wadm = "0.12.2"
-wadm-client = "0.1.2"
-wadm-types = "0.1.0"
+wadm = "0.13.0"
+wadm-client = "0.2.0"
+wadm-types = "0.2.0"
 wasmcloud-operator-types = { version = "*", path = "./crates/types" }
 
 [workspace]
diff --git a/crates/types/Cargo.toml b/crates/types/Cargo.toml
index 9ee412e..369f793 100644
--- a/crates/types/Cargo.toml
+++ b/crates/types/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmcloud-operator-types"
-version = "0.1.6"
+version = "0.1.7"
 edition = "2021"
 
 [dependencies]
diff --git a/crates/types/src/v1alpha1/wasmcloud_host_config.rs b/crates/types/src/v1alpha1/wasmcloud_host_config.rs
index e23493f..46e4337 100644
--- a/crates/types/src/v1alpha1/wasmcloud_host_config.rs
+++ b/crates/types/src/v1alpha1/wasmcloud_host_config.rs
@@ -80,6 +80,8 @@ pub struct WasmCloudHostConfigSpec {
     pub observability: Option<ObservabilityConfiguration>,
     /// Certificates: Authorities, client certificates
     pub certificates: Option<WasmCloudHostCertificates>,
+    /// wasmCloud secrets topic prefix, must not be empty if set.
+    pub secrets_topic_prefix: Option<String>,
 }
 
 #[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
diff --git a/examples/full-config/wasmcloud-annotated.yaml b/examples/full-config/wasmcloud-annotated.yaml
index 667e99a..58a1cb2 100644
--- a/examples/full-config/wasmcloud-annotated.yaml
+++ b/examples/full-config/wasmcloud-annotated.yaml
@@ -68,6 +68,9 @@ spec:
     traces:
       enable: false
       endpoint: "traces-specific-otel-collector.svc"
+  # Optional: Subject prefix that will be used by the host to query for wasmCloud Secrets.
+  # See https://wasmcloud.com/docs/concepts/secrets for more context
+  secretsTopicPrefix: "wasmcloud.secrets"
   # Optional: Additional options to control how the underlying wasmCloud hosts are scheduled in Kubernetes.
   # This includes setting resource requirements for the nats and wasmCloud host
   # containers along with any additional pot template settings.
diff --git a/src/controller.rs b/src/controller.rs
index 1dfe0f1..06b98ce 100644
--- a/src/controller.rs
+++ b/src/controller.rs
@@ -373,6 +373,14 @@ async fn pod_template(config: &WasmCloudHostConfig, ctx: Arc<Context>) -> Result
         }
     }
 
+    if let Some(secrets_prefix) = &config.spec.secrets_topic_prefix {
+        wasmcloud_env.push(EnvVar {
+            name: "WASMCLOUD_SECRETS_TOPIC".to_string(),
+            value: Some(secrets_prefix.clone()),
+            ..Default::default()
+        })
+    }
+
     let mut wasmcloud_args = configure_observability(&config.spec);
 
     let mut nats_resources: Option<k8s_openapi::api::core::v1::ResourceRequirements> = None;
diff --git a/src/openapi.rs b/src/openapi.rs
index 5f7abfd..eb39f6b 100644
--- a/src/openapi.rs
+++ b/src/openapi.rs
@@ -53,6 +53,25 @@ pub struct Metadata {
 pub struct Specification {
     /// The list of components for describing an application
     pub components: Vec<Component>,
+
+    /// The list of policies describing an application. This is for providing application-wide
+    /// setting such as configuration for a secrets backend, how to render Kubernetes services,
+    /// etc. It can be omitted if no policies are needed for an application.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub policies: Vec<Policy>,
+}
+
+/// A policy definition
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq, ToSchema)]
+#[schema(as = dev::oam::core::v1beta1::Policy)]
+pub struct Policy {
+    /// The name of this policy
+    pub name: String,
+    /// The properties for this policy
+    pub properties: BTreeMap<String, String>,
+    /// The type of the policy
+    #[serde(rename = "type")]
+    pub policy_type: String,
 }
 
 /// A component definition
@@ -178,19 +197,20 @@ pub struct Spread {
 #[derive(OpenApi)]
 #[openapi(
     components(schemas(
+        ActorProperties,
         Application,
-        Metadata,
-        Specification,
+        CapabilityConfig,
+        CapabilityProperties,
         Component,
+        LinkdefProperty,
+        Metadata,
+        Policy,
         Properties,
-        ActorProperties,
-        CapabilityProperties,
-        CapabilityConfig,
+        Specification,
+        Spread,
+        SpreadScalerProperty,
         Trait,
         TraitProperty,
-        LinkdefProperty,
-        SpreadScalerProperty,
-        Spread,
     )),
     info(
         description = "The OAM Application API provides a way to manage applications in a Kubernetes cluster."
@@ -266,230 +286,76 @@ async fn openapi_v2() -> impl IntoResponse {
 
 const OPENAPI_V2_SPEC_JSON: &str = r##"
 {
-    "info": {
-      "title": "wasmcloud-operator",
-      "description": "The OAM Application API provides a way to manage applications in a Kubernetes cluster.",
-      "license": {
-        "name": ""
-      },
-      "version": "0.1.6"
+  "swagger": "2.0",
+  "info": {
+    "title": "wasmcloud-operator",
+    "description": "The OAM Application API provides a way to manage applications in a Kubernetes cluster.",
+    "license": {
+      "name": "Apache 2.0"
     },
-    "paths": {
-      "/apis/core.oam.dev/v1beta1": {
-        "get": {
-          "tags": [
-            "crate::router"
-          ],
-          "operationId": "api_resources",
-          "responses": {},
-          "parameters": []
-        }
-      },
-      "/apis/core.oam.dev/v1beta1/namespaces/{namespace}/applications": {
-        "get": {
-          "tags": [
-            "crate::resources::application"
-          ],
-          "operationId": "list_applications",
-          "parameters": [
-            {
-              "name": "namespace",
-              "in": "path",
-              "required": true,
-              "type": "string"
-            }
-          ],
-          "responses": {},
-          "x-kubernetes-group-version-kind": [
-            {
-              "group": "core.oam.dev",
-              "kind": "Application",
-              "version": "v1beta1"
-            }
-          ]
-        },
-        "post": {
-          "tags": [
-            "crate::resources::application"
-          ],
-          "operationId": "create_application",
-          "parameters": [
-            {
-              "name": "namespace",
-              "in": "path",
-              "required": true,
-              "type": "string"
-            },
-            {
-              "description": "",
-              "required": true,
-              "name": "body",
-              "in": "body",
-              "schema": {
-                "type": "string",
-                "format": "binary"
-              }
-            }
-          ],
-          "responses": {},
-          "consumes": [
-            "application/octet-stream"
-          ],
-          "x-kubernetes-group-version-kind": [
-            {
-              "group": "core.oam.dev",
-              "kind": "Application",
-              "version": "v1beta1"
-            }
-          ]
-        }
-      },
-      "/apis/core.oam.dev/v1beta1/namespaces/{namespace}/applications/{name}": {
-        "get": {
-          "tags": [
-            "crate::resources::application"
-          ],
-          "operationId": "get_application",
-          "parameters": [
-            {
-              "name": "namespace",
-              "in": "path",
-              "required": true,
-              "type": "string"
-            },
-            {
-              "name": "name",
-              "in": "path",
-              "required": true,
-              "type": "string"
-            }
-          ],
-          "responses": {},
-          "x-kubernetes-group-version-kind": [
-            {
-              "group": "core.oam.dev",
-              "kind": "Application",
-              "version": "v1beta1"
-            }
-          ]
-        },
-        "delete": {
-          "tags": [
-            "crate::resources::application"
-          ],
-          "operationId": "delete_application",
-          "parameters": [
-            {
-              "name": "namespace",
-              "in": "path",
-              "required": true,
-              "type": "string"
-            },
-            {
-              "name": "name",
-              "in": "path",
-              "required": true,
-              "type": "string"
-            }
-          ],
-          "responses": {},
-          "x-kubernetes-group-version-kind": [
-            {
-              "group": "core.oam.dev",
-              "kind": "Application",
-              "version": "v1beta1"
-            }
-          ]
-        },
-        "patch": {
-          "tags": [
-            "crate::resources::application"
-          ],
-          "operationId": "patch_application",
-          "parameters": [
-            {
-              "name": "namespace",
-              "in": "path",
-              "required": true,
-              "type": "string"
-            },
-            {
-              "name": "name",
-              "in": "path",
-              "required": true,
-              "type": "string"
-            },
-            {
-              "description": "",
-              "required": true,
-              "name": "body",
-              "in": "body",
-              "schema": {
-                "type": "string",
-                "format": "binary"
-              }
-            }
-          ],
-          "responses": {},
-          "consumes": [
-            "application/octet-stream"
-          ],
-          "x-kubernetes-group-version-kind": [
-            {
-              "group": "core.oam.dev",
-              "kind": "Application",
-              "version": "v1beta1"
-            }
-          ]
-        }
+    "version": "0.4.0"
+  },
+  "paths": {
+    "/apis/core.oam.dev/v1beta1": {
+      "get": {
+        "parameters": [],
+        "responses": {},
+        "tags": [
+          "crate::router"
+        ],
+        "operationId": "api_resources"
       }
     },
-    "swagger": "2.0",
-    "definitions": {
-      "dev.oam.core.v1beta1.ActorProperties": {
-        "type": "object",
-        "required": [
-          "image"
-        ],
-        "properties": {
-          "image": {
-            "type": "string",
-            "description": "The image reference to use"
+    "/apis/core.oam.dev/v1beta1/namespaces/{namespace}/applications": {
+      "get": {
+        "parameters": [
+          {
+            "in": "path",
+            "name": "namespace",
+            "required": true,
+            "type": "string"
           }
-        },
+        ],
+        "responses": {},
+        "tags": [
+          "crate::resources::application"
+        ],
+        "operationId": "list_applications",
         "x-kubernetes-group-version-kind": [
           {
             "group": "core.oam.dev",
-            "kind": "ActorProperties",
+            "kind": "Application",
             "version": "v1beta1"
           }
         ]
       },
-      "dev.oam.core.v1beta1.Application": {
-        "type": "object",
-        "description": "An OAM manifest",
-        "required": [
-          "apiVersion",
-          "kind",
-          "metadata",
-          "spec"
-        ],
-        "properties": {
-          "apiVersion": {
-            "type": "string",
-            "description": "The OAM version of the manifest"
-          },
-          "kind": {
-            "type": "string",
-            "description": "The kind or type of manifest described by the spec"
-          },
-          "metadata": {
-            "$ref": "#/definitions/dev.oam.core.v1beta1.Metadata"
+      "post": {
+        "parameters": [
+          {
+            "in": "path",
+            "name": "namespace",
+            "required": true,
+            "type": "string"
           },
-          "spec": {
-            "$ref": "#/definitions/dev.oam.core.v1beta1.Specification"
+          {
+            "description": "",
+            "in": "body",
+            "name": "body",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "binary"
+            }
           }
-        },
+        ],
+        "responses": {},
+        "tags": [
+          "crate::resources::application"
+        ],
+        "operationId": "create_application",
+        "consumes": [
+          "application/octet-stream"
+        ],
         "x-kubernetes-group-version-kind": [
           {
             "group": "core.oam.dev",
@@ -497,283 +363,550 @@ const OPENAPI_V2_SPEC_JSON: &str = r##"
             "version": "v1beta1"
           }
         ]
-      },
-      "dev.oam.core.v1beta1.CapabilityConfig": {
-        "description": "Right now providers can technically use any config format they want, although most use JSON.\nThis enum takes that into account and allows either type of data to be passed",
+      }
+    },
+    "/apis/core.oam.dev/v1beta1/namespaces/{namespace}/applications/{name}": {
+      "delete": {
+        "parameters": [
+          {
+            "in": "path",
+            "name": "namespace",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "type": "string"
+          }
+        ],
+        "responses": {},
+        "tags": [
+          "crate::resources::application"
+        ],
+        "operationId": "delete_application",
         "x-kubernetes-group-version-kind": [
           {
             "group": "core.oam.dev",
-            "kind": "CapabilityConfig",
+            "kind": "Application",
             "version": "v1beta1"
           }
         ]
       },
-      "dev.oam.core.v1beta1.CapabilityProperties": {
-        "type": "object",
-        "required": [
-          "image",
-          "contract"
-        ],
-        "properties": {
-          "config": {
-            "allOf": [
-              {
-                "$ref": "#/definitions/dev.oam.core.v1beta1.CapabilityConfig"
-              }
-            ],
-            "x-nullable": true
-          },
-          "contract": {
-            "type": "string",
-            "description": "The contract ID of this capability"
-          },
-          "image": {
-            "type": "string",
-            "description": "The image reference to use"
+      "get": {
+        "parameters": [
+          {
+            "in": "path",
+            "name": "namespace",
+            "required": true,
+            "type": "string"
           },
-          "link_name": {
-            "type": "string",
-            "description": "An optional link name to use for this capability",
-            "x-nullable": true
+          {
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "type": "string"
           }
-        },
+        ],
+        "responses": {},
+        "tags": [
+          "crate::resources::application"
+        ],
+        "operationId": "get_application",
         "x-kubernetes-group-version-kind": [
           {
             "group": "core.oam.dev",
-            "kind": "CapabilityProperties",
+            "kind": "Application",
             "version": "v1beta1"
           }
         ]
       },
-      "dev.oam.core.v1beta1.Component": {
-        "allOf": [
+      "patch": {
+        "parameters": [
           {
-            "$ref": "#/definitions/dev.oam.core.v1beta1.Properties"
+            "in": "path",
+            "name": "namespace",
+            "required": true,
+            "type": "string"
           },
           {
-            "type": "object",
-            "required": [
-              "name"
-            ],
-            "properties": {
-              "name": {
-                "type": "string",
-                "description": "The name of this component"
-              },
-              "traits": {
-                "type": "array",
-                "items": {
-                  "$ref": "#/definitions/dev.oam.core.v1beta1.Trait"
-                },
-                "description": "A list of various traits assigned to this component",
-                "x-nullable": true
-              }
+            "in": "path",
+            "name": "name",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "description": "",
+            "in": "body",
+            "name": "body",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "binary"
             }
           }
         ],
-        "description": "A component definition",
+        "responses": {},
+        "tags": [
+          "crate::resources::application"
+        ],
+        "operationId": "patch_application",
+        "consumes": [
+          "application/octet-stream"
+        ],
         "x-kubernetes-group-version-kind": [
           {
             "group": "core.oam.dev",
-            "kind": "Component",
+            "kind": "Application",
             "version": "v1beta1"
           }
         ]
+      }
+    }
+  },
+  "definitions": {
+    "dev.oam.core.v1beta1.ActorProperties": {
+      "properties": {
+        "image": {
+          "description": "The image reference to use",
+          "type": "string"
+        }
       },
-      "dev.oam.core.v1beta1.LinkdefProperty": {
-        "type": "object",
-        "description": "Properties for linkdefs",
-        "required": [
-          "target"
-        ],
-        "properties": {
-          "target": {
-            "type": "string",
-            "description": "The target this linkdef applies to. This should be the name of an actor component"
+      "required": [
+        "image"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "ActorProperties",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.Application": {
+      "description": "An OAM manifest",
+      "properties": {
+        "apiVersion": {
+          "description": "The OAM version of the manifest",
+          "type": "string"
+        },
+        "kind": {
+          "description": "The kind or type of manifest described by the spec",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/dev.oam.core.v1beta1.Metadata"
+        },
+        "spec": {
+          "$ref": "#/definitions/dev.oam.core.v1beta1.Specification"
+        }
+      },
+      "required": [
+        "apiVersion",
+        "kind",
+        "metadata",
+        "spec"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "Application",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.CapabilityConfig": {
+      "description": "Right now providers can technically use any config format they want, although most use JSON.\nThis enum takes that into account and allows either type of data to be passed",
+      "oneOf": [
+        {
+          "properties": {
+            "Json": {}
           },
-          "values": {
-            "type": "object",
-            "description": "Values to use for this linkdef",
-            "additionalProperties": {
+          "required": [
+            "Json"
+          ],
+          "type": "object"
+        },
+        {
+          "properties": {
+            "Opaque": {
               "type": "string"
-            },
-            "x-nullable": true
-          }
+            }
+          },
+          "required": [
+            "Opaque"
+          ],
+          "type": "object"
+        }
+      ],
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "CapabilityConfig",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.CapabilityProperties": {
+      "properties": {
+        "config": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/dev.oam.core.v1beta1.CapabilityConfig"
+            }
+          ],
+          "nullable": true
         },
-        "x-kubernetes-group-version-kind": [
-          {
-            "group": "core.oam.dev",
-            "kind": "LinkdefProperty",
-            "version": "v1beta1"
-          }
-        ]
+        "contract": {
+          "description": "The contract ID of this capability",
+          "type": "string"
+        },
+        "image": {
+          "description": "The image reference to use",
+          "type": "string"
+        },
+        "link_name": {
+          "description": "An optional link name to use for this capability",
+          "nullable": true,
+          "type": "string"
+        }
       },
-      "dev.oam.core.v1beta1.Metadata": {
-        "type": "object",
-        "description": "The metadata describing the manifest",
-        "required": [
-          "name"
-        ],
-        "properties": {
-          "annotations": {
-            "type": "object",
-            "description": "Optional data for annotating this manifest",
-            "additionalProperties": {
+      "required": [
+        "image",
+        "contract"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "CapabilityProperties",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.Component": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/dev.oam.core.v1beta1.Properties"
+        },
+        {
+          "properties": {
+            "name": {
+              "description": "The name of this component",
               "type": "string"
+            },
+            "traits": {
+              "description": "A list of various traits assigned to this component",
+              "items": {
+                "$ref": "#/definitions/dev.oam.core.v1beta1.Trait"
+              },
+              "nullable": true,
+              "type": "array"
             }
           },
-          "name": {
-            "type": "string",
-            "description": "The name of the manifest. This should be unique"
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        }
+      ],
+      "description": "A component definition",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "Component",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.LinkdefProperty": {
+      "description": "Properties for linkdefs",
+      "properties": {
+        "target": {
+          "description": "The target this linkdef applies to. This should be the name of an actor component",
+          "type": "string"
+        },
+        "values": {
+          "additionalProperties": {
+            "type": "string"
           },
-          "namespace": {
-            "type": "string",
-            "description": "The namespace for the application."
+          "description": "Values to use for this linkdef",
+          "nullable": true,
+          "type": "object"
+        }
+      },
+      "required": [
+        "target"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "LinkdefProperty",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.Metadata": {
+      "description": "The metadata describing the manifest",
+      "properties": {
+        "annotations": {
+          "additionalProperties": {
+            "type": "string"
           },
-          "labels": {
-            "type": "object",
-            "description": "Optional data for labeling this manifest",
-            "additionalProperties": {
-              "type": "string"
-            }
-          }
+          "description": "Optional data for annotating this manifest",
+          "type": "object"
         },
-        "x-kubernetes-group-version-kind": [
-          {
-            "group": "core.oam.dev",
-            "kind": "Metadata",
-            "version": "v1beta1"
-          }
-        ]
-      },
-      "dev.oam.core.v1beta1.Properties": {
-        "description": "Properties that can be defined for a component",
-        "x-kubernetes-group-version-kind": [
-          {
-            "group": "core.oam.dev",
-            "kind": "Properties",
-            "version": "v1beta1"
-          }
-        ]
+        "labels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object"
+        },
+        "name": {
+          "description": "The name of the manifest. This should be unique",
+          "type": "string"
+        },
+        "namespace": {
+          "type": "string"
+        }
       },
-      "dev.oam.core.v1beta1.Specification": {
-        "type": "object",
-        "description": "A representation of an OAM specification",
-        "required": [
-          "components"
-        ],
+      "required": [
+        "name",
+        "namespace",
+        "labels"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "Metadata",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.Policy": {
+      "description": "A policy definition",
+      "properties": {
+        "name": {
+          "description": "The name of this policy",
+          "type": "string"
+        },
         "properties": {
-          "components": {
-            "type": "array",
-            "items": {
-              "$ref": "#/definitions/dev.oam.core.v1beta1.Component"
-            },
-            "description": "The list of components for describing an application"
-          }
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "The properties for this policy",
+          "type": "object"
         },
-        "x-kubernetes-group-version-kind": [
-          {
-            "group": "core.oam.dev",
-            "kind": "Specification",
-            "version": "v1beta1"
-          }
-        ]
+        "type": {
+          "description": "The type of the policy",
+          "type": "string"
+        }
       },
-      "dev.oam.core.v1beta1.Spread": {
-        "type": "object",
-        "description": "Configuration for various spreading requirements",
-        "required": [
-          "name"
-        ],
-        "properties": {
-          "name": {
-            "type": "string",
-            "description": "The name of this spread requirement"
+      "required": [
+        "name",
+        "properties",
+        "type"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "Policy",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.Properties": {
+      "description": "Properties that can be defined for a component",
+      "discriminator": {
+        "propertyName": "type"
+      },
+      "oneOf": [
+        {
+          "properties": {
+            "properties": {
+              "$ref": "#/definitions/dev.oam.core.v1beta1.ActorProperties"
+            },
+            "type": {
+              "enum": [
+                "actor"
+              ],
+              "type": "string"
+            }
           },
-          "requirements": {
-            "type": "object",
-            "description": "An arbitrary map of labels to match on for scaling requirements",
-            "additionalProperties": {
+          "required": [
+            "properties",
+            "type"
+          ],
+          "type": "object"
+        },
+        {
+          "properties": {
+            "properties": {
+              "$ref": "#/definitions/dev.oam.core.v1beta1.CapabilityProperties"
+            },
+            "type": {
+              "enum": [
+                "capability"
+              ],
               "type": "string"
             }
           },
-          "weight": {
-            "type": "integer",
-            "description": "An optional weight for this spread. Higher weights are given more precedence",
-            "minimum": 0,
-            "x-nullable": true
-          }
+          "required": [
+            "properties",
+            "type"
+          ],
+          "type": "object"
+        }
+      ],
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "Properties",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.Specification": {
+      "description": "A representation of an OAM specification",
+      "properties": {
+        "components": {
+          "description": "The list of components for describing an application",
+          "items": {
+            "$ref": "#/definitions/dev.oam.core.v1beta1.Component"
+          },
+          "type": "array"
         },
-        "x-kubernetes-group-version-kind": [
-          {
-            "group": "core.oam.dev",
-            "kind": "Spread",
-            "version": "v1beta1"
-          }
-        ]
+        "policies": {
+          "description": "The list of policies describing an application. This is for providing application-wide\nsetting such as configuration for a secrets backend, how to render Kubernetes services,\netc. It can be omitted if no policies are needed for an application.",
+          "items": {
+            "$ref": "#/definitions/dev.oam.core.v1beta1.Policy"
+          },
+          "type": "array"
+        }
       },
-      "dev.oam.core.v1beta1.SpreadScalerProperty": {
-        "type": "object",
-        "description": "Properties for spread scalers",
-        "required": [
-          "replicas"
-        ],
-        "properties": {
-          "replicas": {
-            "type": "integer",
-            "description": "Number of replicas to scale",
-            "minimum": 0
+      "required": [
+        "components"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "Specification",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.Spread": {
+      "description": "Configuration for various spreading requirements",
+      "properties": {
+        "name": {
+          "description": "The name of this spread requirement",
+          "type": "string"
+        },
+        "requirements": {
+          "additionalProperties": {
+            "type": "string"
           },
-          "spread": {
-            "type": "array",
-            "items": {
-              "$ref": "#/definitions/dev.oam.core.v1beta1.Spread"
-            },
-            "description": "Requirements for spreading throse replicas"
-          }
+          "description": "An arbitrary map of labels to match on for scaling requirements",
+          "type": "object"
         },
-        "x-kubernetes-group-version-kind": [
-          {
-            "group": "core.oam.dev",
-            "kind": "SpreadScalerProperty",
-            "version": "v1beta1"
-          }
-        ]
+        "weight": {
+          "description": "An optional weight for this spread. Higher weights are given more precedence",
+          "minimum": 0,
+          "nullable": true,
+          "type": "integer"
+        }
       },
-      "dev.oam.core.v1beta1.Trait": {
-        "type": "object",
-        "required": [
-          "type",
-          "properties"
-        ],
-        "properties": {
-          "properties": {
-            "$ref": "#/definitions/dev.oam.core.v1beta1.TraitProperty"
+      "required": [
+        "name"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "Spread",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.SpreadScalerProperty": {
+      "description": "Properties for spread scalers",
+      "properties": {
+        "replicas": {
+          "description": "Number of replicas to scale",
+          "minimum": 0,
+          "type": "integer"
+        },
+        "spread": {
+          "description": "Requirements for spreading throse replicas",
+          "items": {
+            "$ref": "#/definitions/dev.oam.core.v1beta1.Spread"
           },
-          "type": {
-            "type": "string",
-            "description": "The type of trait specified. This should be a unique string for the type of scaler. As we\nplan on supporting custom scalers, these traits are not enumerated"
-          }
+          "type": "array"
+        }
+      },
+      "required": [
+        "replicas"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "SpreadScalerProperty",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "dev.oam.core.v1beta1.Trait": {
+      "properties": {
+        "properties": {
+          "$ref": "#/definitions/dev.oam.core.v1beta1.TraitProperty"
         },
-        "x-kubernetes-group-version-kind": [
-          {
-            "group": "core.oam.dev",
-            "kind": "Trait",
-            "version": "v1beta1"
-          }
-        ]
+        "type": {
+          "description": "The type of trait specified. This should be a unique string for the type of scaler. As we\nplan on supporting custom scalers, these traits are not enumerated",
+          "type": "string"
+        }
       },
-      "dev.oam.core.v1beta1.TraitProperty": {
-        "description": "Properties for defining traits",
-        "x-kubernetes-group-version-kind": [
-          {
-            "group": "core.oam.dev",
-            "kind": "TraitProperty",
-            "version": "v1beta1"
-          }
-        ]
-      }
+      "required": [
+        "type",
+        "properties"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "Trait",
+          "version": "v1beta1"
+        }
+      ]
     },
-    "x-components": {}
+    "dev.oam.core.v1beta1.TraitProperty": {
+      "description": "Properties for defining traits",
+      "oneOf": [
+        {
+          "$ref": "#/definitions/dev.oam.core.v1beta1.LinkdefProperty"
+        },
+        {
+          "$ref": "#/definitions/dev.oam.core.v1beta1.SpreadScalerProperty"
+        },
+        {}
+      ],
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "core.oam.dev",
+          "kind": "TraitProperty",
+          "version": "v1beta1"
+        }
+      ]
+    }
+  },
+  "x-components": {}
 }
+
 "##;
diff --git a/src/services.rs b/src/services.rs
index 6a89d20..e77b8e3 100644
--- a/src/services.rs
+++ b/src/services.rs
@@ -618,13 +618,13 @@ fn http_server_component(manifest: &Manifest) -> Option<HttpServerComponent> {
                 if props.namespace == "wasi"
                     && props.package == "http"
                     && props.interfaces.contains(&"incoming-handler".to_string())
+                    && props.source.is_some()
                 {
-                    for p in props.source_config.iter() {
-                        if let Some(config_props) = &p.properties {
-                            if let Some(addr) = config_props.get("address") {
-                                details.address.clone_from(addr);
-                                should_create_service = true;
-                            };
+                    let source = props.source.as_ref().unwrap();
+                    for cp in source.config.iter() {
+                        if let Some(addr) = cp.properties.as_ref().and_then(|p| p.get("address")) {
+                            details.address.clone_from(addr);
+                            should_create_service = true;
                         }
                     }
                 }