diff --git a/docs/data-sources/config.md b/docs/data-sources/config.md
new file mode 100644
index 0000000..9c79623
--- /dev/null
+++ b/docs/data-sources/config.md
@@ -0,0 +1,21 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "plural_config Data Source - terraform-provider-plural"
+subcategory: ""
+description: |-
+  A representation of a config to authenticate to app.plural.sh
+---
+
+# plural_config (Data Source)
+
+A representation of a config to authenticate to app.plural.sh
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Read-Only
+
+- `email` (String) The email used to authenticate to plural.
+- `token` (String) Access token used to authenticate to plural.
diff --git a/docs/data-sources/group.md b/docs/data-sources/group.md
new file mode 100644
index 0000000..5aed19c
--- /dev/null
+++ b/docs/data-sources/group.md
@@ -0,0 +1,25 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "plural_group Data Source - terraform-provider-plural"
+subcategory: ""
+description: |-
+  A representation of a group to organize authorization in your plural console.
+---
+
+# plural_group (Data Source)
+
+A representation of a group to organize authorization in your plural console.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) Name of this group.
+
+### Read-Only
+
+- `description` (String) Description of this group.
+- `id` (String) Internal identifier of this group.
diff --git a/docs/data-sources/user.md b/docs/data-sources/user.md
new file mode 100644
index 0000000..b442fbc
--- /dev/null
+++ b/docs/data-sources/user.md
@@ -0,0 +1,28 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "plural_user Data Source - terraform-provider-plural"
+subcategory: ""
+description: |-
+  A representation of a user to authenticate to your plural console.
+---
+
+# plural_user (Data Source)
+
+A representation of a user to authenticate to your plural console.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `email` (String) Email address of this user.
+
+### Optional
+
+- `id` (String) Internal identifier of this user.
+
+### Read-Only
+
+- `name` (String) Name of the user.
diff --git a/docs/resources/global_service.md b/docs/resources/global_service.md
new file mode 100644
index 0000000..b24a34a
--- /dev/null
+++ b/docs/resources/global_service.md
@@ -0,0 +1,31 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "plural_global_service Resource - terraform-provider-plural"
+subcategory: ""
+description: |-
+  GlobalService resource
+---
+
+# plural_global_service (Resource)
+
+GlobalService resource
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) Name of this GlobalService.
+- `service_id` (String) The id of the service that will be replicated by this global service.
+
+### Optional
+
+- `distro` (String) Kubernetes distribution for this global servie, eg EKS, AKS, GKE, K3S.
+- `provider_id` (String) Id of a CAPI provider that this global service targets.
+- `tags` (Map of String) Key-value tags used to target clusters for this global service.
+
+### Read-Only
+
+- `id` (String) Internal identifier of this GlobalService.
diff --git a/docs/resources/group.md b/docs/resources/group.md
new file mode 100644
index 0000000..f8df71d
--- /dev/null
+++ b/docs/resources/group.md
@@ -0,0 +1,28 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "plural_group Resource - terraform-provider-plural"
+subcategory: ""
+description: |-
+  group resource
+---
+
+# plural_group (Resource)
+
+group resource
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) Name of this group.
+
+### Optional
+
+- `description` (String) Description of this group.
+
+### Read-Only
+
+- `id` (String) Internal identifier of this group.
diff --git a/docs/resources/group_member.md b/docs/resources/group_member.md
new file mode 100644
index 0000000..4a96bf7
--- /dev/null
+++ b/docs/resources/group_member.md
@@ -0,0 +1,25 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "plural_group_member Resource - terraform-provider-plural"
+subcategory: ""
+description: |-
+  GroupMember resource
+---
+
+# plural_group_member (Resource)
+
+GroupMember resource
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `group_id` (String) group id for this group member.
+- `user_id` (String) user id for this group member.
+
+### Read-Only
+
+- `id` (String) Internal identifier of this group member.
diff --git a/docs/resources/rbac.md b/docs/resources/rbac.md
new file mode 100644
index 0000000..e7c9d16
--- /dev/null
+++ b/docs/resources/rbac.md
@@ -0,0 +1,49 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "plural_rbac Resource - terraform-provider-plural"
+subcategory: ""
+description: |-
+  A representation of rbac settings for a provider or cluster.
+---
+
+# plural_rbac (Resource)
+
+A representation of rbac settings for a provider or cluster.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Optional
+
+- `bindings` (Attributes) Read and write policies of this resource. (see [below for nested schema](#nestedatt--bindings))
+- `cluster_id` (String) The cluster id for these rbac settings
+- `service_id` (String) The service id for these rbac settings
+
+<a id="nestedatt--bindings"></a>
+### Nested Schema for `bindings`
+
+Optional:
+
+- `read` (Attributes Set) Read policies of this resource. (see [below for nested schema](#nestedatt--bindings--read))
+- `write` (Attributes Set) Write policies of this resource. (see [below for nested schema](#nestedatt--bindings--write))
+
+<a id="nestedatt--bindings--read"></a>
+### Nested Schema for `bindings.read`
+
+Optional:
+
+- `group_id` (String)
+- `id` (String)
+- `user_id` (String)
+
+
+<a id="nestedatt--bindings--write"></a>
+### Nested Schema for `bindings.write`
+
+Optional:
+
+- `group_id` (String)
+- `id` (String)
+- `user_id` (String)
diff --git a/internal/resource/cluster.go b/internal/resource/cluster.go
index 9645688..7ea1965 100644
--- a/internal/resource/cluster.go
+++ b/internal/resource/cluster.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/samber/lo"
 	"k8s.io/apimachinery/pkg/util/wait"
 )
 
@@ -128,6 +129,26 @@ func (r *clusterResource) Update(ctx context.Context, req resource.UpdateRequest
 		return
 	}
 
+	if !data.HelmRepoUrl.Equal(state.HelmRepoUrl) && data.HasKubeconfig() {
+		clusterWithToken, err := r.client.GetClusterWithToken(ctx, data.Id.ValueStringPointer(), nil)
+		if err != nil {
+			resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to fetch cluster deploy token, got error: %s", err))
+			return
+		}
+
+		handler, err := NewOperatorHandler(ctx, r.client, data.GetKubeconfig(), data.HelmRepoUrl.ValueString(), data.HelmValues.ValueStringPointer(), r.consoleUrl)
+		if err != nil {
+			resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to init operator handler, got error: %s", err))
+			return
+		}
+
+		err = handler.InstallOrUpgrade(lo.FromPtr(clusterWithToken.Cluster.DeployToken))
+		if err != nil {
+			resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to install operator, got error: %s", err))
+			return
+		}
+	}
+
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 }