diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index be1a9a4..8209f22 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -14,21 +14,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v4.3.0
         with:
-          version: latest
+          version: v3.18.4 # Also update in release.yml
 
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.3.1
+        uses: helm/chart-testing-action@v2.7.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -53,20 +53,3 @@ jobs:
       - name: Run chart-testing (lint)
         run: ct lint --config ct.yaml --lint-conf lintconf.yaml
         if: steps.list-changed.outputs.changed == 'true'
-
-      - name: Create kind cluster
-        uses: helm/kind-action@v1.5.0
-        if: steps.list-changed.outputs.changed == 'true'
-        #with:
-        #  kubectl_version: v1.22.0
-
-      # Install Dependencies
-      - name: Install Required dependencies
-        if: steps.list-changed.outputs.changed == 'true'
-        run: |
-          kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
-          kubectl create -f https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.58.0/bundle.yaml
-
-      - name: Run chart-testing (install)
-        run: ct install --config ct.yaml
-        if: steps.list-changed.outputs.changed == 'true'
diff --git a/.github/workflows/pr-label.yml b/.github/workflows/pr-label.yml
index b9fd062..6baec19 100644
--- a/.github/workflows/pr-label.yml
+++ b/.github/workflows/pr-label.yml
@@ -13,6 +13,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: size-label
-        uses: "pascalgn/size-label-action@v0.4.2"
+        uses: "pascalgn/size-label-action@v0.5.5"
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/pr-validate.yml b/.github/workflows/pr-validate.yml
index 97a4d6f..4e4f808 100644
--- a/.github/workflows/pr-validate.yml
+++ b/.github/workflows/pr-validate.yml
@@ -12,7 +12,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: morrisoncole/pr-lint-action@v1.5.0
+      - uses: morrisoncole/pr-lint-action@v1.7.1
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           title-regex: '^\[[a-zA-Z0-9\,\_\-]+\]\:.+'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ce0a77..23a08f8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,14 +17,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Install Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
         with:
-          version: v3.10.1 # Also update in lint-and-test.yaml
+          version: v3.18.4 # Also update in lint-and-test.yml
 
       - name: Add dependency chart repos
         run: |
@@ -35,7 +35,7 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.4.1
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         with:
           charts_dir: charts
         env:
diff --git a/.gitignore b/.gitignore
index b7ab50a..8976a26 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,5 @@ Sessionx.vim
 .idea/
 .intellij/
 *.iml
+.project
+.settings
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c05aded..b5b6f44 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,20 +2,20 @@
 repos:
 
   - repo: https://github.com/pre-commit/pre-commit-hooks.git
-    rev: v4.3.0
+    rev: v5.0.0
     hooks:
       - id: end-of-file-fixer
         exclude_types: ['markdown']
-        stages: [commit]
+        stages: [pre-commit]
       - id: trailing-whitespace
         exclude_types: ['markdown']
-        stages: [commit]
+        stages: [pre-commit]
       - id: mixed-line-ending
-        stages: [commit]
+        stages: [pre-commit]
       - id: check-byte-order-marker
-        stages: [commit]
+        stages: [pre-commit]
       - id: check-executables-have-shebangs
-        stages: [commit]
+        stages: [pre-commit]
       - id: check-merge-conflict
 
   - repo: local
@@ -26,11 +26,11 @@ repos:
         args: ["helm-docs"]
         language: system
         pass_filenames: false
-        stages: [commit]
+        stages: [pre-commit]
       - id: ct-lint
         name: ct-lint
         entry: make
         args: ["helm-lint"]
         language: system
         pass_filenames: false
-        stages: [commit]
+        stages: [pre-commit]
diff --git a/CODEOWNERS b/CODEOWNERS
index 90acac1..9d87f07 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -1 +1 @@
-*      @bedag/sre
+* @bedag/syx2 @bedag/apc
diff --git a/Makefile b/Makefile
index 74a3552..10c311a 100644
--- a/Makefile
+++ b/Makefile
@@ -2,11 +2,11 @@
 # Helm
 SRC_ROOT = $(shell git rev-parse --show-toplevel)
 
-helm-docs: HELMDOCS_VERSION := v1.11.0
+helm-docs: HELMDOCS_VERSION := v1.14.2
 helm-docs: docker
 	@docker run -v "$(SRC_ROOT):/helm-docs" jnorwood/helm-docs:$(HELMDOCS_VERSION) --chart-search-root /helm-docs
 
-helm-lint: CT_VERSION := v3.3.1
+helm-lint: CT_VERSION := v3.13.0
 helm-lint: docker
 	@docker run -v "$(SRC_ROOT):/workdir" --entrypoint /bin/sh quay.io/helmpack/chart-testing:$(CT_VERSION) -c "cd /workdir; ct lint --config ct.yaml --lint-conf lintconf.yaml --all --debug"
 
diff --git a/charts/common/Chart.yaml b/charts/common/Chart.yaml
index 82def37..ad3a2ae 100644
--- a/charts/common/Chart.yaml
+++ b/charts/common/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: common
 description: "Bedag's common Helm chart to use for creating other Helm charts"
-version: 10.2.0
+version: 12.7.0
 # A chart can be either an 'application' or a 'library' chart.
 #
 # Application charts are a collection of templates that can be packaged into versioned archives
@@ -27,4 +27,5 @@ annotations:
   artifacthub.io/prerelease: "false"
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
-    - "[Added]: support for clusterIP field"
+    - "[Changed]: extra annotations and labels support sprig statements"
+    - "[Added]: Possibility to optionally set appVersion in values"
diff --git a/charts/common/README.md b/charts/common/README.md
index 88a7bf2..1ab27b4 100644
--- a/charts/common/README.md
+++ b/charts/common/README.md
@@ -1,6 +1,6 @@
 # common
 
-![Version: 10.2.0](https://img.shields.io/badge/Version-10.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 12.7.0](https://img.shields.io/badge/Version-12.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Bedag's common Helm chart to use for creating other Helm charts
 
@@ -23,6 +23,8 @@ Major Changes to functions are documented with the version affected. **Before up
 |logPersistence removed|8.0.0|Removes logPersistence functionality as it can be achieved with volumeMounts & extraVolumeClaimTemplates and is buggy anyway.|https://github.com/bedag/helm-charts/pull/68|
 |networkpolicy template changes|9.0.0|add possibility to define more than one Port in networkpolicy|https://github.com/bedag/helm-charts/pull/70|
 |networkpolicy template changes|10.0.0|add possibility to create multiple networkpolicies|https://github.com/bedag/helm-charts/pull/77|
+|ingress template changes|11.0.0|add possibility to create multiple ingress objects|https://github.com/bedag/helm-charts/pull/134
+|ingress template changes|12.0.0|support defining multiple hosts and secrets for one ingress|https://github.com/bedag/helm-charts/pull/138
 
 # Values by Component
 
@@ -30,25 +32,28 @@ Major Changes to functions are documented with the version affected. **Before up
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| ingress.annotations | object | `{"nginx.ingress.kubernetes.io/ssl-redirect":"true"}` | annotations is a dictionary for defining ingress controller specific annotations |
-| ingress.deploy | bool | `false` | deploy has to be set to true for rendering to be applied |
-| ingress.ingressClassName | string | `""` | ingressClassName, defines the class of the ingress controller. |
-| ingress.rules[0] | object | `{"host":"myapp.cluster.local","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}}` | host is the URL which ingress is listening |
-| ingress.rules[0].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends |
-| ingress.rules[0].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends |
-| ingress.rules[0].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to |
-| ingress.rules[0].http.paths[0].backend.serviceNameSuffix | string | `"component-1"` | serviceNameSuffix describes the suffix of the serviceName |
-| ingress.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) |
-| ingress.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening |
-| ingress.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") |
-| ingress.tls.existing.secret | string | `""` | name of an existing secret with tls.crt & tls.key content |
-| ingress.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. |
-| ingress.tls.provided.key | string | `""` | The key must not have a passphrase |
-| ingress.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: |
-| ingress.tls.self.alternativeDnsNames | list | `[]` | alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom |
-| ingress.tls.self.commonName | string | `"*.cluster.local"` | commonName of the certificate (mandatory) |
-| ingress.tls.self.ipAddresses | list | `[]` | ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section |
-| ingress.tls.self.validityDuration | int | `365` | validityDuration defines how long the certificate is valid (in days) |
+| ingresses.ingress-1.annotations | object | `{"nginx.ingress.kubernetes.io/ssl-redirect":"true"}` | annotations is a dictionary for defining ingress controller specific annotations |
+| ingresses.ingress-1.annotations."nginx.ingress.kubernetes.io/ssl-redirect" | string | `"true"` | nginx.ingress.kubernetes.io/ssl-redirect needs to be set to 'true' when using SSL/TLS offloading with a LB outside of Kubernetes |
+| ingresses.ingress-1.deploy | bool | `false` | deploy has to be set to true for rendering to be applied |
+| ingresses.ingress-1.ingressClassName | string | `""` | ingressClassName, defines the class of the ingress controller. |
+| ingresses.ingress-1.rules | list | `[{"host":"myapp.cluster.local","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]},"secretName":""}]` | rules is a list of host rules used to configure the Ingress |
+| ingresses.ingress-1.rules[0] | object | `{"host":"myapp.cluster.local","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]},"secretName":""}` | host is the URL which ingress is listening |
+| ingresses.ingress-1.rules[0].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends |
+| ingresses.ingress-1.rules[0].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends |
+| ingresses.ingress-1.rules[0].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to |
+| ingresses.ingress-1.rules[0].http.paths[0].backend.serviceNameSuffix | string | `"component-1"` | serviceNameSuffix describes the suffix of the serviceName |
+| ingresses.ingress-1.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) |
+| ingresses.ingress-1.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening |
+| ingresses.ingress-1.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") |
+| ingresses.ingress-1.rules[0].secretName | string | `""` | name of existing secrets with tls.crt & tls.key content |
+| ingresses.ingress-1.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. |
+| ingresses.ingress-1.tls.provided.key | string | `""` | The key must not have a passphrase |
+| ingresses.ingress-1.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: |
+| ingresses.ingress-1.tls.self.alternativeDnsNames | list | `[]` | alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom |
+| ingresses.ingress-1.tls.self.commonName | string | `"*.cluster.local"` | commonName of the certificate (mandatory) |
+| ingresses.ingress-1.tls.self.ipAddresses | list | `[]` | ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section |
+| ingresses.ingress-1.tls.self.validityDuration | int | `365` | validityDuration defines how long the certificate is valid (in days) |
+| ingresses.ingress-1.tls.type | string | `"none"` | define your type of tls certificate, it can be one of: none: tls will be disabled existing: use an existing secret already present in the namespace. Requires `secretName` to be specified in `.rules.host` provided: use an officially generated certificate/key k8s: use the default k8s-ingress tls. no further configuration needed self: generate a self signed certificate, which is stored as secret. Needs commonName and validityDuration at least |
 
 ## ServiceMonitor
 
diff --git a/charts/common/README.md.gotmpl b/charts/common/README.md.gotmpl
index 9d7e9de..42bf92a 100644
--- a/charts/common/README.md.gotmpl
+++ b/charts/common/README.md.gotmpl
@@ -32,6 +32,8 @@ Major Changes to functions are documented with the version affected. **Before up
 |logPersistence removed|8.0.0|Removes logPersistence functionality as it can be achieved with volumeMounts & extraVolumeClaimTemplates and is buggy anyway.|https://github.com/bedag/helm-charts/pull/68|
 |networkpolicy template changes|9.0.0|add possibility to define more than one Port in networkpolicy|https://github.com/bedag/helm-charts/pull/70|
 |networkpolicy template changes|10.0.0|add possibility to create multiple networkpolicies|https://github.com/bedag/helm-charts/pull/77|
+|ingress template changes|11.0.0|add possibility to create multiple ingress objects|https://github.com/bedag/helm-charts/pull/134
+|ingress template changes|12.0.0|support defining multiple hosts and secrets for one ingress|https://github.com/bedag/helm-charts/pull/138
 {{/*
   Chart Values
 */}}
@@ -49,7 +51,7 @@ Major Changes to functions are documented with the version affected. **Before up
 
 {{ template "table.heading" . }}
 {{- range .Values }}
-  {{- if and (hasPrefix "ingress." .Key) }}
+  {{- if and (hasPrefix "ingresses.ingress-1" .Key) }}
 | {{ .Key }} | {{ .Type }} | {{ if .Default }}{{ .Default }}{{ else }}{{ .AutoDefault }}{{ end }} | {{ if .Description }}{{ .Description }}{{ else }}{{ .AutoDescription }}{{ end }} |
   {{- end }}
 {{- end }}
diff --git a/charts/common/ci/values.test.yaml b/charts/common/ci/values.test.yaml
index 9f6d16e..71e698c 100644
--- a/charts/common/ci/values.test.yaml
+++ b/charts/common/ci/values.test.yaml
@@ -1,3 +1,19 @@
+# includes is used to include the desired template functions (see templates/includes.yaml)
+includes:
+  networkpolicy: true
+  deployment: true
+  statefulset: true
+  service: true
+  envSecret: true
+  envConfigMap: true
+  # files is needed for mounted volumes (secrets or configmaps)
+  files: true
+  configFiles: true
+  binaryFiles: true
+  pvcs: true
+  job: true
+  cronjob: true
+
 # start common.ingress
 ingress:
   deploy: true
@@ -64,6 +80,15 @@ components:
     controller:
       deploy: true
       type: "Deployment"
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "foo.local"
+        - "bar.local"
+      - ip: "10.1.2.3"
+        hostnames:
+        - "foo.remote"
+        - "bar.remote"
 
       containers:
         container-1:
@@ -139,6 +164,12 @@ components:
               mountPath: /opt/my-binary-license
               content: 'base64 encoded data'
           resources: {}
+      initContainers:
+        init-container-1:
+          image:
+            repository: db-init
+            tag: "latest"
+          resources: {}
   component-2:
     # start common.service
     services:
@@ -179,7 +210,22 @@ components:
         - name: emptydir-volume
           type: "emptyDir"
           sizeLimit: 100Mi
+        - name: secret-store
+          type: "csi"
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: "azure-kvname"
 
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "foo.local"
+        - "bar.local"
+      - ip: "10.1.2.3"
+        hostnames:
+        - "foo.remote"
+        - "bar.remote"
       containers:
         container-1:
           image:
@@ -257,6 +303,16 @@ components:
         runAsNonRoot: true
         runAsUser: 1001
 
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "foo.local"
+        - "bar.local"
+      - ip: "10.1.2.3"
+        hostnames:
+        - "foo.remote"
+        - "bar.remote"
+
       # start containers
       # dictionary of containers in a pod
       containers:
@@ -317,6 +373,16 @@ components:
         runAsNonRoot: true
         runAsUser: 1001
 
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "foo.local"
+        - "bar.local"
+      - ip: "10.1.2.3"
+        hostnames:
+        - "foo.remote"
+        - "bar.remote"
+
       # start containers
       # dictionary of containers in a pod
       containers:
diff --git a/charts/common/templates/_binaryfiles.yaml b/charts/common/templates/_binaryfiles.yaml
index 49c7a45..66a9ab2 100644
--- a/charts/common/templates/_binaryfiles.yaml
+++ b/charts/common/templates/_binaryfiles.yaml
@@ -4,7 +4,7 @@
 {{- if $componentValues.controller }}
 {{- if $componentValues.controller.deploy }}
 {{- if or $componentValues.controller.containers $componentValues.controller.initContainers }}
-{{- $containers := merge ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
+{{- $containers := merge (dict) ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
 {{- range $containerName, $containerValues := $containers }}
 {{- $configBinarys := $containerValues.binaryFiles }}
 {{- if $configBinarys }}
diff --git a/charts/common/templates/_configfiles.yaml b/charts/common/templates/_configfiles.yaml
index 1acc10e..893c176 100644
--- a/charts/common/templates/_configfiles.yaml
+++ b/charts/common/templates/_configfiles.yaml
@@ -30,7 +30,7 @@ Sensitive configs goes inside a Secret and non-sensitive configs are put in a Co
 {{- if $componentValues.controller }}
 {{- if $componentValues.controller.deploy }}
 {{- if or $componentValues.controller.containers $componentValues.controller.initContainers }}
-{{- $containers := merge ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
+{{- $containers := merge (dict) ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
 {{- range $containerName, $containerValues := $containers }}
 {{- $configFiles := $containerValues.configFiles }}
 {{- if $configFiles }}
diff --git a/charts/common/templates/_configmap.yaml b/charts/common/templates/_configmap.yaml
index e014af5..c6ac791 100644
--- a/charts/common/templates/_configmap.yaml
+++ b/charts/common/templates/_configmap.yaml
@@ -3,8 +3,23 @@
 {{- range $componentName, $componentValues := .Values.components }}
 {{- if $componentValues.controller }}
 {{- if $componentValues.controller.deploy }}
+{{- $podConfigMap := $componentValues.controller.envConfigMap }}
+{{- if $podConfigMap }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "library.name" $root }}-{{ $componentName }}
+  labels:
+{{ include "library.labels.standard" $root | indent 4 }}
+    app.kubernetes.io/component: {{ $componentName }}
+data:
+{{- range $key, $value := $podConfigMap }}
+  {{ $key }}: {{ $value | quote }}
+{{- end }}
+{{- end }}
 {{- if or $componentValues.controller.containers $componentValues.controller.initContainers }}
-{{- $containers := merge ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
+{{- $containers := merge (dict) ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
 {{- range $containerName, $containerValues := $containers }}
 {{- $configMap := $containerValues.envConfigMap }}
 {{- if $configMap }}
diff --git a/charts/common/templates/_container.yaml b/charts/common/templates/_container.yaml
index f07c0a1..e88056e 100644
--- a/charts/common/templates/_container.yaml
+++ b/charts/common/templates/_container.yaml
@@ -1,6 +1,7 @@
 {{- define "common.container" -}}
 {{- $root := .root }}
 {{- $componentName := .componentName }}
+{{- $controllerValues := .controllerValues }}
 {{- $containerName := .containerName }}
 {{- $containerValues := .containerValues }}
 {{- $configFiles := .configFiles }}
@@ -16,7 +17,7 @@
   env:
     - name: TZ
       value: {{ default "Europe/Zurich" $root.Values.timezone | quote }}
-  {{- with $containerValues.env  }}
+  {{- with $containerValues.env }}
     {{- if (kindIs "slice" .) }}
       {{- toYaml . | nindent 4 }}
     {{- else }}
@@ -27,7 +28,7 @@
     {{- end }}
   {{- end }}
   ports:
-  {{- with $containerValues.containerPorts  }}
+  {{- with $containerValues.containerPorts }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
   resources: {{- toYaml $containerValues.resources | nindent 4 }}
@@ -69,8 +70,22 @@
       subPath: {{ $key }}
     {{- end }}
   {{- end }}
-  {{- if or $containerValues.envSecret $containerValues.envConfigMap }}
+  {{- if or $containerValues.envFrom $controllerValues.envFrom $containerValues.envSecret $containerValues.envConfigMap $controllerValues.envSecret $controllerValues.envConfigMap }}
   envFrom:
+    {{- with $containerValues.envFrom }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with $controllerValues.envFrom }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- if $controllerValues.envSecret }}
+    - secretRef:
+        name: {{ template "library.name" $root }}-{{ $componentName }}
+    {{- end }}
+    {{- if $controllerValues.envConfigMap }}
+    - configMapRef:
+        name: {{ template "library.name" $root }}-{{ $componentName }}
+    {{- end }}
     {{- if $containerValues.envSecret }}
     - secretRef:
         name: {{ template "library.name" $root }}-{{ $componentName }}-{{ $containerName }}
diff --git a/charts/common/templates/_cronjob.yaml b/charts/common/templates/_cronjob.yaml
index 7838942..2e2e30e 100644
--- a/charts/common/templates/_cronjob.yaml
+++ b/charts/common/templates/_cronjob.yaml
@@ -32,16 +32,12 @@ spec:
       labels:
 {{ include "library.labels.stable" $root | indent 8 }}
         app.kubernetes.io/component: {{ $name }}
-        {{- range $key, $value := $cronjob.extraLabels }}
-        {{ $key }}: {{ $value }}
-        {{- end }}
+        {{- include "library.mapify" (dict "map" $cronjob.extraLabels "ctx" $root) | nindent 8 }}
         {{- if $cronjob.gatherMetrics }}
         gatherMetrics: "enabled"
         {{- end }}
       annotations:
-        {{- range $key, $value := $cronjob.extraAnnotations }}
-        {{ $key }}: {{ $value | quote }}
-        {{- end }}
+        {{- include "library.mapify" (dict "map" $cronjob.extraAnnotations "ctx" $root) | nindent 8 }}
     spec:
 {{- include "common.jobspec" (dict "root" $root "job" $cronjob "name" $name) | indent 6 }}
 {{- end }}
diff --git a/charts/common/templates/_deployment.yaml b/charts/common/templates/_deployment.yaml
index 9aaef05..24de138 100644
--- a/charts/common/templates/_deployment.yaml
+++ b/charts/common/templates/_deployment.yaml
@@ -39,9 +39,7 @@ spec:
       labels:
 {{ include "library.labels.stable" $root | indent 8 }}
         app.kubernetes.io/component: {{ $name }}
-        {{- range $key, $value := $deployment.extraLabels }}
-        {{ $key }}: {{ $value }}
-        {{- end }}
+        {{- include "library.mapify" (dict "map" $deployment.extraLabels "ctx" $root) | nindent 8 }}
         {{- if $deployment.gatherMetrics }}
         gatherMetrics: "enabled"
         {{- end }}
@@ -51,14 +49,12 @@ spec:
         # and thus re-pull the image even if the tag has not changed (if imagePullPolicy = Always)
         timestamp: {{ now.Unix | quote }}
         {{- end }}
-        {{- range $key, $value := $deployment.extraAnnotations }}
-        {{ $key }}: {{ $value | quote }}
-        {{- end }}
+        {{- include "library.mapify" (dict "map" $deployment.extraAnnotations "ctx" $root) | nindent 8 }}
         {{- range $deployment.extraChecksumAnnotations }}
         {{ .key }}: {{ include (print $.Template.BasePath .checksumFrom) $root | sha256sum }}
         {{- end }}
         {{- if or $deployment.containers $deployment.initContainers }}
-        {{- $containers := merge ($deployment.containers | default dict) ($deployment.initContainers | default dict) }}
+        {{- $containers := merge (dict) ($deployment.containers | default dict) ($deployment.initContainers | default dict) }}
         {{- range $containerName, $containerValues := $containers }}
         {{- $configMap := $containerValues.envConfigMap }}
         {{- if and $configMap (not $deployment.disableChecksumAnnotations) }}
diff --git a/charts/common/templates/_ingress-ingress.yaml b/charts/common/templates/_ingress-ingress.yaml
index 1834e5b..547e99f 100644
--- a/charts/common/templates/_ingress-ingress.yaml
+++ b/charts/common/templates/_ingress-ingress.yaml
@@ -1,14 +1,15 @@
 {{- define "common.ingress.ingress" -}}
 {{- $root := . }}
-{{- $ingress := .Values.ingress }}
+{{- $ingresses := .Values.ingresses }}
+{{- range $name, $ingress := $ingresses }}
 {{- if $ingress.deploy }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ template "library.name" . }}-ingress
+  name: {{ template "library.name" $root }}-{{$name}}
   labels:
-{{ include "library.labels.standard" . | indent 4 }}
+{{ include "library.labels.standard" $root | indent 4 }}
     app.kubernetes.io/component: ingress
 {{- if $ingress.annotations }}
   annotations:
@@ -16,6 +17,20 @@ metadata:
 {{- end }}
 spec:
   ingressClassName: {{ $ingress.ingressClassName }}
+  {{- if $ingress.defaultBackend }}
+  {{- if not $ingress.rules }}
+  defaultBackend:
+    service:
+      name: {{ template "library.name" $root }}-{{ $ingress.defaultBackend.serviceNameSuffix }}
+      port:
+        {{- if kindIs "float64" $ingress.defaultBackend.servicePort }}
+        number: {{ $ingress.defaultBackend.servicePort }}
+        {{- else }}
+        name: {{ $ingress.defaultBackend.servicePort | quote }}
+        {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- if not $ingress.defaultBackend }}
   rules:
     {{- range $ingress.rules }}
     - host: {{ .host }}
@@ -38,16 +53,18 @@ spec:
   {{- if $ingress.tls }}
   {{- if and (ne $ingress.tls.type "none") (ne $ingress.tls.type "") }}
   tls:
+    {{- range $ingress.rules }}
     - hosts:
-      {{- range $ingress.rules }}
         - {{ .host }}
-      {{- end }}
       {{- if or (eq $ingress.tls.type "self") (eq $ingress.tls.type "provided") }}
-      secretName: {{ template "library.name" . }}-ingress-tls
+      secretName: {{ regexReplaceAll "\\W+" .host "-" }}
       {{- else if eq $ingress.tls.type "existing" }}
-      secretName: {{ $ingress.tls.existing.secret }}
+      secretName: {{ .secretName }}
       {{- end }}
+    {{- end }}
+  {{- end }}
   {{- end }}
   {{- end }}
 {{- end }}
+{{- end }}
 {{- end -}}
diff --git a/charts/common/templates/_ingress-secret.yaml b/charts/common/templates/_ingress-secret.yaml
index 409262c..13f0261 100644
--- a/charts/common/templates/_ingress-secret.yaml
+++ b/charts/common/templates/_ingress-secret.yaml
@@ -1,5 +1,7 @@
 {{- define "common.ingress.secret" -}}
-{{- $ingress := .Values.ingress }}
+{{- $root := . }}
+{{- $ingresses := .Values.ingresses }}
+{{- range $name, $ingress := $ingresses }}
 {{- $cert := "" }}
 {{- if $ingress }}
 {{- if $ingress.deploy }}
@@ -9,13 +11,14 @@
 {{- $cert = buildCustomCert $ingress.tls.provided.cert $ingress.tls.provided.key }}
 {{- end }}
 {{ if or (eq $ingress.tls.type "self") (eq $ingress.tls.type "provided")}}
+{{- range $ingress.rules }}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ template "library.name" . }}-ingress-tls
+  name: {{ regexReplaceAll "\\W+" .host "-" }}
   labels:
-{{ include "library.labels.standard" . | indent 4 }}
+{{ include "library.labels.standard" $root | indent 4 }}
     app.kubernetes.io/component: ingress-tls
 type: Opaque
 data:
@@ -25,3 +28,5 @@ data:
 {{- end }}
 {{- end }}
 {{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/common/templates/_jobspec.yaml b/charts/common/templates/_jobspec.yaml
index b8fdbe2..0d8ac8b 100644
--- a/charts/common/templates/_jobspec.yaml
+++ b/charts/common/templates/_jobspec.yaml
@@ -27,7 +27,7 @@ template:
 {{ include "library.labels.stable" $root | indent 6 }}
       app.kubernetes.io/component: {{ $name }}
       {{- range $key, $value := $job.extraLabels }}
-      {{ $key }}: {{ $value }}
+      {{ $key }}: {{ $value | quote }}
       {{- end }}
       {{- if $job.gatherMetrics }}
       gatherMetrics: "enabled"
diff --git a/charts/common/templates/_pod.yaml b/charts/common/templates/_pod.yaml
index 26fd776..9957c4a 100644
--- a/charts/common/templates/_pod.yaml
+++ b/charts/common/templates/_pod.yaml
@@ -1,10 +1,13 @@
 {{- define "common.pod" -}}
+{{- $root := .root }}
+{{- $name := .name }}
+{{- $controllerValues := .controller }}
 
 {{- /*
 Distinguish between sensitive and non-sensitive config, first initialize empty dictionaries
 (We need to know this here also, to specify the volumes or not)
 */ -}}
-{{- $configFiles := .controller.configFiles }}
+{{- $configFiles := $controllerValues.configFiles }}
 {{- $secretConfigs := dict }}
 {{- $nonSecretConfigs := dict }}
 {{- /* now separating the configs */ -}}
@@ -16,51 +19,87 @@ Distinguish between sensitive and non-sensitive config, first initialize empty d
   {{- end }}
 {{- end }}
 
-{{- $root := .root }}
-{{- $name := .name }}
-{{- if .controller.serviceAccountName }}
-serviceAccountName: {{ .controller.serviceAccountName | quote }}
+{{- if $controllerValues.hostAliases }}
+hostAliases:
+  {{- with $controllerValues.hostAliases }}
+  {{- toYaml . | nindent 2 }}
+  {{- end -}}
 {{- end }}
-automountServiceAccountToken: {{ .controller.automountServiceAccountToken | default false }}
-{{- if .controller.priorityClassName }}
-priorityClassName: {{ .controller.priorityClassName | quote }}
+
+{{- if $controllerValues.serviceAccountName }}
+serviceAccountName: {{ $controllerValues.serviceAccountName | quote }}
+{{- end }}
+automountServiceAccountToken: {{ $controllerValues.automountServiceAccountToken | default false }}
+{{- if $controllerValues.priorityClassName }}
+priorityClassName: {{ $controllerValues.priorityClassName | quote }}
 {{- end }}
-{{- if .controller.restartPolicy }}
-restartPolicy: {{ .controller.restartPolicy | quote }}
+{{- if $controllerValues.restartPolicy }}
+restartPolicy: {{ $controllerValues.restartPolicy | quote }}
 {{- end }}
-{{- if .controller.containers }}
+{{- if and (ne $controllerValues.terminationGracePeriodSeconds nil) (ge (int $controllerValues.terminationGracePeriodSeconds) 0) }}
+terminationGracePeriodSeconds: {{ $controllerValues.terminationGracePeriodSeconds }}
+{{- end }}
+{{- if $controllerValues.containers }}
 containers:
-{{- range $containerName, $containerValues := .controller.containers }}
-{{- include "common.container" (dict "root" $root "componentName" $name "containerName" $containerName "containerValues" $containerValues "configFiles" $configFiles) | indent 2 }}
+{{- range $containerName, $containerValues := $controllerValues.containers }}
+{{- include "common.container" (dict "root" $root "componentName" $name "controllerValues" $controllerValues "containerName" $containerName "containerValues" $containerValues "configFiles" $configFiles) | indent 2 }}
 {{- end }}
 {{- end }}
-{{- if .controller.initContainers }}
+{{- if $controllerValues.initContainers }}
 initContainers:
-{{- range $containerName, $containerValues := .controller.initContainers }}
-{{- include "common.container" (dict "root" $root "componentName" $name "containerName" $containerName "containerValues" $containerValues "configFiles" $configFiles) | indent 2 }}
+{{- range $containerName, $containerValues := $controllerValues.initContainers }}
+{{- include "common.container" (dict "root" $root "componentName" $name "controllerValues" $controllerValues "containerName" $containerName "containerValues" $containerValues "configFiles" $configFiles) | indent 2 }}
 {{- end }}
 {{- end }}
-{{- if .controller.podSecurityContext }}
-{{- if .controller.podSecurityContext.enabled }}
-securityContext: {{- omit .controller.podSecurityContext "enabled" | toYaml | nindent 2 }}
+{{- if $controllerValues.podSecurityContext }}
+{{- if $controllerValues.podSecurityContext.enabled }}
+securityContext: {{- omit $controllerValues.podSecurityContext "enabled" | toYaml | nindent 2 }}
 {{- end }}
 {{- end }}
 volumes:
-  {{- range .controller.volumes }}
+  {{- range $controllerValues.volumes }}
   {{- if and .name .type }}
   - name: {{ template "library.name" $root }}-{{ .name }}
   {{- if eq .type "secret" }}
     secret:
+      {{- if .existing }}
+      secretName: {{ .name }}
+      {{- if .optional }}
+      optional: true
+      {{- end }}
+      {{- if .items }}
+      items:
+      {{- range .items }}
+        - key: {{ .key }}
+          path: {{ .path }}
+      {{- end }}
+      {{- end }}
+      {{- else }}
       secretName: {{ template "library.name" $root }}-{{ .name }}
+      {{- end }}
       {{- if .defaultMode }}
       defaultMode: {{ .defaultMode }}
       {{- end }}
   {{- else if eq .type "configMap" }}
     configMap:
+      {{- if .existing }}
+      name: {{ .name }}
+      {{- if .optional }}
+      optional: true
+      {{- end }}
+      {{- if .items }}
+      items:
+      {{- range .items }}
+        - key: {{ .key }}
+          path: {{ .path }}
+      {{- end }}
+      {{- end }}
+      {{- else }}
       name: {{ template "library.name" $root }}-{{ .name }}
       {{- if .defaultMode }}
       defaultMode: {{ .defaultMode }}
       {{- end }}
+      {{- end }}
   {{- else if eq .type "persistentVolumeClaim" }}
     persistentVolumeClaim:
       claimName: {{ template "library.name" $root }}-{{ .claimNameSuffix }}
@@ -79,11 +118,33 @@ volumes:
     {{- else }}
     emptyDir: {}
     {{- end }}
+  {{- else if eq .type "external" }}
+    {{- if .pvcName }}
+    persistentVolumeClaim:
+      claimName: {{ .pvcName }}
+      {{- if .readOnly }}
+      readOnly: {{ .readOnly }}
+      {{- end }}
+    {{- end }}
+  {{- else if eq .type "csi" }}
+    {{- if .driver }}
+    csi:
+      driver: {{ .driver }}
+      {{- if .readOnly }}
+      readOnly: {{ .readOnly }}
+      {{- end }}
+      {{- if .volumeAttributes }}
+      volumeAttributes:
+        {{- range $key, $val := .volumeAttributes }}
+        {{ $key }}: {{ $val }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
   {{- end }}
   {{- end }}
   {{- end }}
-  {{- if or .controller.containers .controller.initContainers }}
-  {{- $containers := merge (.controller.containers | default dict) (.controller.initContainers | default dict) }}
+  {{- if or $controllerValues.containers $controllerValues.initContainers }}
+  {{- $containers := merge (dict) ($controllerValues.containers | default dict) ($controllerValues.initContainers | default dict) }}
   {{- range $containerName, $containerValues := $containers }}
   {{- $configFiles := $containerValues.configFiles }}
   {{- if $configFiles }}
@@ -101,11 +162,17 @@ volumes:
   - name: {{ $containerName }}-configfiles
     configMap:
       name: {{ template "library.name" $root }}-{{ $name }}-{{ $containerName }}-configfiles
+      {{- if $containerValues.configFilesDefaultMode }}
+      defaultMode: {{ $containerValues.configFilesDefaultMode }}
+      {{- end }}
   {{- end }}
   {{- if $secretConfigs }}
   - name: {{ $containerName }}-secret-configfiles
     secret:
       secretName: {{ template "library.name" $root }}-{{ $name }}-{{ $containerName }}-secret-configfiles
+      {{- if $containerValues.configFilesDefaultMode }}
+      defaultMode: {{ $containerValues.configFilesDefaultMode }}
+      {{- end }}
   {{- end }}
   {{- end }}
   {{- $binaryFiles := $containerValues.binaryFiles }}
@@ -116,26 +183,34 @@ volumes:
   {{- end }}
   {{- end }}
   {{- end }}
-{{- with .controller.nodeSelector }}
+{{- with $controllerValues.nodeSelector }}
 nodeSelector:
 {{ toYaml . | indent 2 }}
 {{- end }}
-{{- with .controller.affinity }}
+{{- with $controllerValues.affinity }}
 affinity:
 {{ toYaml . | indent 2 }}
 {{- end }}
-{{- with .controller.tolerations }}
+{{- with $controllerValues.tolerations }}
 tolerations:
 {{ toYaml . | indent 2 }}
 {{- end }}
+{{- with $controllerValues.topologySpreadConstraints }}
+topologySpreadConstraints:
+{{ toYaml . | indent 2 }}
+{{- end }}
 {{- if $root.Values.secrets }}
 {{- if $root.Values.secrets.data }}
 {{- if $root.Values.secrets.data.registry }}
-{{- if $root.Values.secrets.data.registry.pullSecret }}
+{{- if $root.Values.secrets.data.registry.pullSecret.enabled }}
 imagePullSecrets:
+{{- if $root.Values.secrets.data.registry.pullSecret.name }}
+  - name: {{ $root.Values.secrets.data.registry.pullSecret.name }}
+{{- else }}
   - name: {{ template "library.name" $root }}-registry-pull-secret
 {{- end }}
 {{- end }}
 {{- end }}
 {{- end }}
+{{- end }}
 {{- end -}}
diff --git a/charts/common/templates/_pvcs.yaml b/charts/common/templates/_pvcs.yaml
index 5299476..cc936c9 100644
--- a/charts/common/templates/_pvcs.yaml
+++ b/charts/common/templates/_pvcs.yaml
@@ -7,6 +7,10 @@ kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: {{ template "library.name" $root }}-{{ .name }}
+  {{- with .annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   labels:
 {{ include "library.labels.stable" $root | indent 4 }}
 spec:
diff --git a/charts/common/templates/_secret.yaml b/charts/common/templates/_secret.yaml
index dbc3f84..f195d1a 100644
--- a/charts/common/templates/_secret.yaml
+++ b/charts/common/templates/_secret.yaml
@@ -3,8 +3,24 @@
 {{- range $componentName, $componentValues := .Values.components }}
 {{- if $componentValues.controller }}
 {{- if $componentValues.controller.deploy }}
+{{- $podSecret:= $componentValues.controller.envSecret }}
+{{- if $podSecret }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "library.name" $root }}-{{ $componentName }}
+  labels:
+{{ include "library.labels.standard" $root | indent 4 }}
+    app.kubernetes.io/component: {{ $componentName }}
+type: Opaque
+data:
+{{- range $key, $value := $podSecret }}
+  {{ $key }}: {{ $value | b64enc | quote }}
+{{- end }}
+{{- end }}
 {{- if or $componentValues.controller.containers $componentValues.controller.initContainers }}
-{{- $containers := merge ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
+{{- $containers := merge (dict) ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
 {{- range $containerName, $containerValues := $containers }}
 {{- $secret := $containerValues.envSecret }}
 {{- if $secret }}
diff --git a/charts/common/templates/_service.yaml b/charts/common/templates/_service.yaml
index b196bf3..3e1eacb 100644
--- a/charts/common/templates/_service.yaml
+++ b/charts/common/templates/_service.yaml
@@ -21,9 +21,6 @@ spec:
   {{- if $service.loadBalancerClass }}
   loadBalancerClass: {{ $service.loadBalancerClass }}
   {{- end }}
-  {{- if $service.clusterIP }}
-  clusterIP: {{ . }}
-  {{- end }}
   {{- if $service.loadBalancerSourceRanges }}
   loadBalancerSourceRanges:
   {{- with $service.loadBalancerSourceRanges }}
@@ -31,6 +28,9 @@ spec:
   {{- end }}
   {{- end }}
   {{- end }}
+  {{- if $service.clusterIP }}
+  clusterIP: {{ $service.clusterIP }}
+  {{- end }}
   ports:
     - name: {{ $service.name | default "http" }}
       port: {{ $service.port | default "80" }}
diff --git a/charts/common/templates/_servicemonitor-servicemonitor.yaml b/charts/common/templates/_servicemonitor-servicemonitor.yaml
index cf17cd5..13045cb 100644
--- a/charts/common/templates/_servicemonitor-servicemonitor.yaml
+++ b/charts/common/templates/_servicemonitor-servicemonitor.yaml
@@ -19,6 +19,9 @@ spec:
   endpoints:
   - path: {{ .path | default "/metrics" }}
     interval: {{ .interval | default "30s" }}
+    {{- if .scrapeTimeout }}
+    scrapeTimeout: {{ .scrapeTimeout }}
+    {{- end }}
     port: {{ .port | default "http" }}
     {{- if $root.Values.servicemonitor.basicAuth.enabled }}
     basicAuth:
diff --git a/charts/common/templates/_statefulset.yaml b/charts/common/templates/_statefulset.yaml
index ab651f0..8e85562 100644
--- a/charts/common/templates/_statefulset.yaml
+++ b/charts/common/templates/_statefulset.yaml
@@ -29,9 +29,7 @@ spec:
       labels:
 {{ include "library.labels.stable" $root | indent 8 }}
         app.kubernetes.io/component: {{ $name }}
-        {{- range $key, $value := $statefulset.extraLabels }}
-        {{ $key }}: {{ $value }}
-        {{- end }}
+        {{- include "library.mapify" (dict "map" $statefulset.extraLabels "ctx" $root) | nindent 8 }}
         {{- if $statefulset.gatherMetrics }}
         gatherMetrics: "enabled"
         {{- end }}
@@ -41,14 +39,12 @@ spec:
         # and thus re-pull the image even if the tag has not changed (if imagePullPolicy = Always)
         timestamp: {{ now.Unix | quote}}
         {{- end }}
-        {{- range $key, $value := $statefulset.extraAnnotations }}
-        {{ $key }}: {{ $value | quote }}
-        {{- end }}
+        {{- include "library.mapify" (dict "map" $statefulset.extraAnnotations "ctx" $root) | nindent 8 }}
         {{- range $statefulset.extraChecksumAnnotations }}
         {{ .key }}: {{ include (print $.Template.BasePath .checksumFrom) $root | sha256sum }}
         {{- end }}
         {{- if or $statefulset.containers $statefulset.initContainers }}
-        {{- $containers := merge ($statefulset.containers | default dict) ($statefulset.initContainers | default dict) }}
+        {{- $containers := merge (dict) ($statefulset.containers | default dict) ($statefulset.initContainers | default dict) }}
         {{- range $containerName, $containerValues := $containers }}
         {{- $configMap := $containerValues.envConfigMap }}
         {{- if and $configMap (not $statefulset.disableChecksumAnnotations) }}
diff --git a/charts/common/templates/helpers/_labels.tpl b/charts/common/templates/helpers/_labels.tpl
index afe06fd..7eaf7d1 100644
--- a/charts/common/templates/helpers/_labels.tpl
+++ b/charts/common/templates/helpers/_labels.tpl
@@ -1,14 +1,13 @@
 {{- /*
-library.labelize takes a dict or map and generates labels.
-Values will be quoted. Keys will not.
-Example output:
-  first: "Matt"
-  last: "Butcher"
+library.mapify is used to generate annotations and labels
+where the value can be templated with the given context
 */ -}}
-{{- define "library.labelize" -}}
-{{- range $k, $v := . }}
-{{ $k }}: {{ $v | quote }}
-{{- end -}}
+{{- define "library.mapify" -}}
+  {{- if $.map -}}
+    {{- range $k, $v := $.map -}}
+      {{- $k | nindent 0 }}: {{ (tpl $v $.ctx) | quote }}
+    {{- end -}}
+  {{- end -}}
 {{- end -}}
 
 {{- /*
@@ -22,7 +21,7 @@ app.kubernetes.io/name: {{ template "library.name" . }}
 helm.sh/chart: {{ template "library.chartrefshort" . }}
 app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
 app.kubernetes.io/instance: {{ .Release.Name | quote }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Values.appVersion | default .Chart.AppVersion | quote }}
 {{- end -}}
 
 {{- /*
diff --git a/charts/common/templates/includes.yaml b/charts/common/templates/includes.yaml
index 9c459ba..c947881 100644
--- a/charts/common/templates/includes.yaml
+++ b/charts/common/templates/includes.yaml
@@ -1,61 +1,58 @@
-{{- /* This file is used for developing & testing the common chart.
-Uncomment each "template" line to use the corresponding function */ -}}
-
-{{- /* ingress
-{{- template "common.ingress.ingress" . }}
-{{- template "common.ingress.secret" . }}
-*/ -}}
-
-{{- /* services
-{{- template "common.service" . }}
-*/ -}}
-
-{{- /* statefulset
-{{- template "common.statefulset" . }}
-*/ -}}
-
-{{- /* deployment
-{{- template "common.deployment" . }}
-*/ -}}
-
-{{- /* job
-{{- template "common.job" . }}
-*/ -}}
-
-{{- /* cronjob
-{{- template "common.cronjob" . }}
-*/ -}}
-
-{{- /* envSecret
-{{- template "common.controller.envSecret" . }}
-*/ -}}
-
-{{- /* envConfigMap
-{{- template "common.controller.envConfigMap" . }}
-*/ -}}
-
-{{- /* configFiles
-{{- template "common.controller.configFiles" . }}
-*/ -}}
-
-{{- /* binaryFiles
-{{- template "common.controller.binaryFiles" . }}
-*/ -}}
-
-{{- /* files
-{{- template "common.controller.files" . }}
-*/ -}}
-
-{{- /* pvcs
-{{- template "common.pvcs" . }}
-*/ -}}
-
-{{- /* servicemonitor
-{{- template "common.servicemonitor.headless.service" . }}
-{{- template "common.servicemonitor.servicemonitor" . }}
-{{- template "common.servicemonitor.secret" . }}
-*/ -}}
-
-{{- /* networkpolicy
-{{- template "common.networkpolicy" . }}
-*/ -}}
+{{- if .Values.includes.ingress }}
+  {{- template "common.ingress.ingress" . }}
+  {{- template "common.ingress.secret" . }}
+{{- end }}
+
+{{- if .Values.includes.service }}
+  {{- template "common.service" . }}
+{{- end -}}
+
+{{- if .Values.includes.statefulset }}
+  {{- template "common.statefulset" . }}
+{{- end -}}
+
+{{- if .Values.includes.deployment }}
+  {{- template "common.deployment" . }}
+{{- end -}}
+
+{{- if .Values.includes.job }}
+  {{- template "common.job" . }}
+{{- end -}}
+
+{{- if .Values.includes.cronjob }}
+  {{- template "common.cronjob" . }}
+{{- end -}}
+
+{{- if .Values.includes.envSecret }}
+  {{- template "common.controller.envSecret" . }}
+{{- end -}}
+
+{{- if .Values.includes.envConfigMap }}
+  {{- template "common.controller.envConfigMap" . }}
+{{- end -}}
+
+{{- if .Values.includes.configFiles }}
+  {{- template "common.controller.configFiles" . }}
+{{- end -}}
+
+{{- if .Values.includes.binaryFiles }}
+  {{- template "common.controller.binaryFiles" . }}
+{{- end -}}
+
+{{- if .Values.includes.files }}
+  {{- template "common.controller.files" . }}
+{{- end -}}
+
+{{- if .Values.includes.pvcs }}
+  {{- template "common.pvcs" . }}
+{{- end -}}
+
+{{- if .Values.includes.servicemonitor }}
+  {{- template "common.servicemonitor.headless.service" . }}
+  {{- template "common.servicemonitor.servicemonitor" . }}
+  {{- template "common.servicemonitor.secret" . }}
+{{- end -}}
+
+{{- if .Values.includes.networkpolicy }}
+  {{- template "common.networkpolicy" . }}
+{{- end -}}
diff --git a/charts/common/values.schema.json b/charts/common/values.schema.json
index b682867..df19cf3 100644
--- a/charts/common/values.schema.json
+++ b/charts/common/values.schema.json
@@ -87,9 +87,15 @@
         "envSecret": {
           "type": "object"
         },
+        "envFrom": {
+          "type": ["array"]
+        },
         "envConfigMap": {
           "type": "object"
         },
+        "configFilesDefaultMode": {
+          "type": "integer"
+        },
         "configFiles": {
           "type": "object",
           "patternProperties": {
@@ -265,6 +271,9 @@
           "type": "string",
           "default": "30s"
         },
+        "scrapeTimeout": {
+          "type": "string"
+        },
         "overrideUserKey": {
           "type": "string"
         },
@@ -352,6 +361,17 @@
     }
   },
   "properties": {
+    "appVersion": {
+      "title": "SemVer check",
+      "description": "https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string using ECMA compatible regex with double escaping (\\)",
+      "type": "string",
+      "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$",
+      "examples": [
+        "1.0.0",
+        "1.0.0-beta",
+        "1.2.1"
+      ]
+    },
     "defaultTag": {
       "title": "SemVer check",
       "description": "https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string using ECMA compatible regex with double escaping (\\) and option for 'latest' but then be compatible with postgres-tag format of XX.MM (without patch part)",
@@ -362,6 +382,83 @@
         "1.0.0"
       ]
     },
+    "includes": {
+      "type": "object",
+      "required": [
+        "ingress",
+        "service",
+        "statefulset",
+        "deployment",
+        "job",
+        "cronjob",
+        "envSecret",
+        "envConfigMap",
+        "configFiles",
+        "binaryFiles",
+        "files",
+        "pvcs",
+        "servicemonitor",
+        "networkpolicy"
+      ],
+      "properties": {
+        "ingress": {
+          "type": "boolean",
+          "default": false
+        },
+        "service": {
+          "type": "boolean",
+          "default": false
+        },
+        "statefulset": {
+          "type": "boolean",
+          "default": false
+        },
+        "deployment": {
+          "type": "boolean",
+          "default": false
+        },
+        "job": {
+          "type": "boolean",
+          "default": false
+        },
+        "cronjob": {
+          "type": "boolean",
+          "default": false
+        },
+        "envSecret": {
+          "type": "boolean",
+          "default": false
+        },
+        "envConfigMap": {
+          "type": "boolean",
+          "default": false
+        },
+        "configFiles": {
+          "type": "boolean",
+          "default": false
+        },
+        "binaryFiles": {
+          "type": "boolean",
+          "default": false
+        },
+        "files": {
+          "type": "boolean",
+          "default": false
+        },
+        "pvcs": {
+          "type": "boolean",
+          "default": false
+        },
+        "servicemonitor": {
+          "type": "boolean",
+          "default": false
+        },
+        "networkpolicy": {
+          "type": "boolean",
+          "default": false
+        }
+      }
+    },
     "secrets": {
       "type": "object",
       "properties": {
@@ -378,7 +475,19 @@
               ],
               "properties": {
                 "pullSecret": {
-                  "type": "string"
+                  "type": "object",
+                  "required": [
+                    "enabled"
+                  ],
+                  "properties": {
+                    "enabled": {
+                      "type": "boolean",
+                      "default": false
+                    },
+                    "name": {
+                      "type": "string"
+                    }
+                  }
                 }
               }
             }
@@ -398,165 +507,190 @@
         }
       }
     },
-    "ingress": {
+    "ingresses": {
       "type": "object",
-      "required": [
-        "deploy"
-      ],
-      "if": {
-        "properties": {
-          "deploy": {
-            "const": true
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "rules",
-          "annotations",
-          "tls"
-        ]
-      },
-      "properties": {
-        "deploy": {
-          "type": "boolean",
-          "default": false
-        },
-        "ingressClassName": {
-          "type": "string"
-        },
-        "rules": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "required": [
-              "host",
-              "http"
-            ],
+      "patternProperties": {
+        "^.*$": {
+          "type": "object",
+          "required": [
+            "deploy"
+          ],
+          "if": {
             "properties": {
-              "host": {
-                "type": "string",
-                "examples": [
-                  "myapp.cluster.local"
-                ]
-              },
-              "http": {
+              "deploy": {
+                "const": true
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "tls"
+            ]
+          },
+          "properties": {
+            "deploy": {
+              "type": "boolean",
+              "default": false
+            },
+            "ingressClassName": {
+              "type": "string"
+            },
+            "defaultBackend":{
+                "type":"object",
+                "required": [
+                    "serviceNameSuffix",
+                    "servicePort"
+                ],
+                "properties": {
+                    "serviceNameSuffix": {
+                        "type": "string"
+                    },
+                    "servicePort": {
+                        "type": [
+                        "number",
+                        "string"
+                        ]
+                    }
+                }
+            },
+            "rules": {
+              "type": "array",
+              "items": {
                 "type": "object",
                 "required": [
-                  "paths"
+                  "host",
+                  "http"
                 ],
                 "properties": {
-                  "paths": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "required": [
-                        "backend",
-                        "path"
-                      ],
-                      "properties": {
-                        "backend": {
+                  "host": {
+                    "type": "string",
+                    "examples": [
+                      "myapp.cluster.local"
+                    ]
+                  },
+                  "http": {
+                    "type": "object",
+                    "required": [
+                      "paths"
+                    ],
+                    "properties": {
+                      "paths": {
+                        "type": "array",
+                        "items": {
                           "type": "object",
                           "required": [
-                            "serviceNameSuffix",
-                            "servicePort"
+                            "backend",
+                            "path"
                           ],
                           "properties": {
-                            "serviceNameSuffix": {
-                              "type": "string"
+                            "backend": {
+                              "type": "object",
+                              "required": [
+                                "serviceNameSuffix",
+                                "servicePort"
+                              ],
+                              "properties": {
+                                "serviceNameSuffix": {
+                                  "type": "string"
+                                },
+                                "servicePort": {
+                                  "type": [
+                                    "number",
+                                    "string"
+                                  ]
+                                }
+                              }
+                            },
+                            "path": {
+                              "type": "string",
+                              "examples": [
+                                "/"
+                              ]
                             },
-                            "servicePort": {
-                              "type": [
-                                "number",
-                                "string"
+                            "pathType": {
+                              "type": "string",
+                              "default": "ImplementationSpecific",
+                              "examples": [
+                                "ImplementationSpecific",
+                                "Exact",
+                                "Prefix"
                               ]
                             }
                           }
-                        },
-                        "path": {
-                          "type": "string",
-                          "examples": [
-                            "/"
-                          ]
-                        },
-                        "pathType": {
-                          "type": "string",
-                          "default": "ImplementationSpecific",
-                          "examples": [
-                            "ImplementationSpecific",
-                            "Exact",
-                            "Prefix"
-                          ]
                         }
                       }
                     }
+                  },
+                  "secretName": {
+                    "type": "string"
                   }
                 }
               }
-            }
-          }
-        },
-        "annotations": {
-          "type": "object"
-        },
-        "tls": {
-          "type": "object",
-          "required": [
-            "type"
-          ],
-          "properties": {
-            "type": {
-              "type": "string",
-              "default": "none"
-            },
-            "existing": {
-              "type": "object",
-              "required": [
-                "secret"
-              ],
-              "properties": {
-                "secret": {
-                  "type": "string"
-                }
-              }
             },
-            "provided": {
-              "type": "object",
-              "required": [
-                "cert",
-                "key"
-              ],
-              "properties": {
-                "cert": {
-                  "type": "string"
-                },
-                "key": {
-                  "type": "string"
-                }
-              }
+            "annotations": {
+              "type": "object"
             },
-            "self": {
+            "tls": {
               "type": "object",
               "required": [
-                "commonName",
-                "validityDuration"
+                "type"
               ],
               "properties": {
-                "commonName": {
-                  "type": "string"
-                },
-                "ipAddresses": {
-                  "type": "array"
+                "type": {
+                  "type": "string",
+                  "default": "none"
                 },
-                "alternativeDnsNames": {
-                  "type": "array"
+                "provided": {
+                  "type": "object",
+                  "required": [
+                    "cert",
+                    "key"
+                  ],
+                  "properties": {
+                    "cert": {
+                      "type": "string"
+                    },
+                    "key": {
+                      "type": "string"
+                    }
+                  }
                 },
-                "validityDuration": {
-                  "type": "integer"
+                "self": {
+                  "type": "object",
+                  "required": [
+                    "commonName",
+                    "validityDuration"
+                  ],
+                  "properties": {
+                    "commonName": {
+                      "type": "string"
+                    },
+                    "ipAddresses": {
+                      "type": "array"
+                    },
+                    "alternativeDnsNames": {
+                      "type": "array"
+                    },
+                    "validityDuration": {
+                      "type": "integer"
+                    }
+                  }
                 }
               }
             }
-          }
+          },
+          "oneOf": [
+            {
+                "required": [
+                    "rules"
+                ]
+            },
+            {
+                "required": [
+                    "defaultBackend"
+                ]
+            }
+          ]
         }
       }
     },
@@ -646,6 +780,9 @@
               "name-of-pvc"
             ]
           },
+          "annotations": {
+            "type": "object"
+          },
           "size": {
             "type": "string",
             "default": "1Gi"
@@ -746,6 +883,15 @@
                 "extraLabels": {
                   "type": "object"
                 },
+                "envSecret": {
+                  "type": "object"
+                },
+                "envConfigMap": {
+                  "type": "object"
+                },
+                "envFrom": {
+                  "type": ["array"]
+                },
                 "replicas": {
                   "type": "integer",
                   "default": 1
@@ -908,6 +1054,11 @@
                     "OnFailure"
                   ]
                 },
+                "terminationGracePeriodSeconds": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "default": 30
+                },
                 "podSecurityContext": {
                   "type": "object",
                   "properties": {
@@ -947,12 +1098,55 @@
                   "type": "array",
                   "items": {
                     "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string"
+                      },
+                      "type": {
+                        "type": "string"
+                      },
+                      "existing": {
+                        "type": "boolean"
+                      },
+                      "optional": {
+                        "type": "boolean"
+                      },
+                      "items": {
+                        "type": "array",
+                        "properties": {
+                          "key": {
+                            "type": "string"
+                          },
+                          "path": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    },
                     "required": [
                       "name",
                       "type"
                     ]
                   }
                 },
+                "hostAliases": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "ip": {
+                        "type": "string"
+                      },
+                      "hostnames": {
+                        "type": "array"
+                      }
+                    },
+                    "required": [
+                      "ip",
+                      "hostnames"
+                    ]
+                  }
+                },
                 "containers": {
                   "type": "object",
                   "patternProperties": {
diff --git a/charts/common/values.yaml b/charts/common/values.yaml
index eda4944..20a82a6 100644
--- a/charts/common/values.yaml
+++ b/charts/common/values.yaml
@@ -10,17 +10,43 @@
 # nameSuffix: ""
 # nameOverride: ""
 
+## appVersion is optional to override the default .Chart.appVersion
+# appVersion: "1.0.0"
+
 # defaultTag is used when no imageTag is specified in .Values.components.*.controller.image.tag
 defaultTag: latest
 
+# includes is used to include the desired template functions (see templates/includes.yaml)
+includes:
+  ingress: false
+  service: false
+  statefulset: false
+  deployment: false
+  job: false
+  cronjob: false
+  envSecret: false
+  envConfigMap: false
+  configFiles: false
+  binaryFiles: false
+  # files is needed for mounted volumes (secrets or configmaps)
+  files: false
+  pvcs: false
+  servicemonitor: false
+  networkpolicy: false
+
 # timezone to set as environment variable 'TZ' in each pod. Comment out for using default ("Europe/Zurich")
 # timezone: "Europe/Zurich"
 
-# secrets contains the pullSecret for the container registry to pull images.
+# secrets contains the pullSecret for the container registry to pull images. Set 'enabled' to 'true' to use a pullSecret.
+# The secret name consists of the 'library.name' variable and the suffix '-registry-pull-secret' if 'name' is not specified.
 secrets:
   data:
     registry:
-      pullSecret: ""
+      pullSecret:
+        # enabled activates the imagePullSecrets in the pod spec
+        enabled: false
+        # name is optional to override the default name, if omitted uses '{{ template "library.name" $root }}-registry-pull-secret'
+        # name: example-foo
 
 # start common.networkpolicy
 # -- networkpolicy restricts all access between the pods. To configure allowed connections, go to components.*.networkpolicy.podSelector
@@ -31,68 +57,79 @@ networkpolicy:
 
 # start common.ingress
 # -- ingress is used for access from outside of kubernetes
-ingress:
-  # -- deploy has to be set to true for rendering to be applied
-  deploy: false
-  # -- ingressClassName, defines the class of the ingress controller.
-  ingressClassName: ""
-  # rules is a list of host rules used to configure the Ingress
-  rules:
-    # -- host is the URL which ingress is listening
-    - host: myapp.cluster.local
-      # -- http is a list of http selectors pointing to backends
-      http:
-        # -- paths is a list of paths that map requests to backends
-        paths:
-          # -- backend defines the referenced service endpoint to which the traffic will be forwarded to
-          - backend:
-              # -- serviceNameSuffix describes the suffix of the serviceName
-              serviceNameSuffix: component-1
-              # -- servicePort describes the port where the service is listening at (can be either a string or a number)
-              servicePort: http
-            # -- path which ingress is listening
-            path: "/"
-            # -- pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific")
-            pathType: "ImplementationSpecific"
-
-  # -- annotations is a dictionary for defining ingress controller specific annotations
-  annotations:
-    # nginx.ingress.kubernetes.io/proxy-buffer-size known to be necessary for keycloak because defaults are too small
-    # nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-    # nginx.ingress.kubernetes.io/ssl-redirect needs to be set to 'true' when using SSL/TLS offloading with a LB outside of Kubernetes
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-  # tls configuration
-  tls:
-    # define your type of tls certificate, it can be one of:
-    # none: tls will be disabled
-    # existing: use an existing secret already present in the namespace. Requires secret name to be specified
-    # provided: use an officially generated certificate/key
-    # k8s: use the default k8s-ingress tls. no further configuration needed
-    # self: generate a self signed certificate, which is stored as secret. Needs commonName and validityDuration at least
-    type: "none"
-    # -- depending on the type you have further configuration options:
-    self:
-      # -- commonName of the certificate (mandatory)
-      commonName: "*.cluster.local"
-      # -- ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section
-      ipAddresses: []
-      #  - "10.0.0.1"
-      # -- alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom
-      alternativeDnsNames: []
-      #  - "foo.com"
-      # -- validityDuration defines how long the certificate is valid (in days)
-      validityDuration: 365
-    existing:
-      # -- name of an existing secret with tls.crt & tls.key content
-      secret: ""
-    provided:
-      # -- If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key
-      # Has to be base64 encoded and should be encrypted in the ejson vault
-      # Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails.
-      cert: ""
-      # -- The key must not have a passphrase
-      key: ""
-# end common.ingress
+# -- ingresses are a dictionary of single ingresses to be configured
+ingresses:
+  ingress-1:
+    # -- deploy has to be set to true for rendering to be applied
+    deploy: false
+    # -- ingressClassName, defines the class of the ingress controller.
+    ingressClassName: ""
+    # START ONLY FOR SINGLE-SERVICE INGRESSES AND NOT RULESETS
+    # -- defaultBackend may be used if only a single Service Backend with no Rulesets is needed.
+    # defaultBackend:
+      # -- serviceNameSuffix describes the suffix of the serviceName
+      # serviceNameSuffix: component-1
+      # -- servicePort describes the port where the service is listening at (can be either a string or a number)
+      # servicePort: http
+    # END ONLY FOR SINGLE-SERVICE INGRESSES AND NOT RULESETS
+    # START ONLY FOR MULTI-SERVICE INGRESSES AND/OR SPECIFIC RULES
+    # -- rules is a list of host rules used to configure the Ingress
+    rules:
+      # -- host is the URL which ingress is listening
+      - host: myapp.cluster.local
+        # -- http is a list of http selectors pointing to backends
+        http:
+          # -- paths is a list of paths that map requests to backends
+          paths:
+            # -- backend defines the referenced service endpoint to which the traffic will be forwarded to
+            - backend:
+                # -- serviceNameSuffix describes the suffix of the serviceName
+                serviceNameSuffix: component-1
+                # -- servicePort describes the port where the service is listening at (can be either a string or a number)
+                servicePort: http
+              # -- path which ingress is listening
+              path: "/"
+              # -- pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific")
+              pathType: "ImplementationSpecific"
+        # -- name of existing secrets with tls.crt & tls.key content
+        secretName: ""
+    # END ONLY FOR MULTI-SERVICE INGRESSES AND/OR SPECIFIC RULES
+
+    # -- annotations is a dictionary for defining ingress controller specific annotations
+    annotations:
+      # -- nginx.ingress.kubernetes.io/proxy-buffer-size known to be necessary for keycloak because defaults are too small
+      # nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
+      # -- nginx.ingress.kubernetes.io/ssl-redirect needs to be set to 'true' when using SSL/TLS offloading with a LB outside of Kubernetes
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    # tls configuration
+    tls:
+      # -- define your type of tls certificate, it can be one of:
+      # none: tls will be disabled
+      # existing: use an existing secret already present in the namespace. Requires `secretName` to be specified in `.rules.host`
+      # provided: use an officially generated certificate/key
+      # k8s: use the default k8s-ingress tls. no further configuration needed
+      # self: generate a self signed certificate, which is stored as secret. Needs commonName and validityDuration at least
+      type: "none"
+      # -- depending on the type you have further configuration options:
+      self:
+        # -- commonName of the certificate (mandatory)
+        commonName: "*.cluster.local"
+        # -- ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section
+        ipAddresses: []
+        #  - "10.0.0.1"
+        # -- alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom
+        alternativeDnsNames: []
+        #  - "foo.com"
+        # -- validityDuration defines how long the certificate is valid (in days)
+        validityDuration: 365
+      provided:
+        # -- If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key
+        # Has to be base64 encoded and should be encrypted in the ejson vault
+        # Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails.
+        cert: ""
+        # -- The key must not have a passphrase
+        key: ""
+# end common.ingresses
 
 # start common.servicemonitor
 # servicemonitor is from CoreOS and lets you scrape metrics with the prometheus-operators
@@ -133,6 +170,8 @@ servicemonitor:
       # path: /metrics
       # interval sets the scrape interval. Comment out for using default ("30s")
       # interval: 30s
+      # scrapeTimeout sets the scrape timeout. Comment out for using default (global timeout of your prometheus)
+      # scrapeTimeout: 30s
       # port is used for matching the headless service. Comment out for using default ("http")
       # port: http
     # custom-komponente is a sample endpoint
@@ -162,6 +201,8 @@ servicemonitor:
 pvcs:
     # -- specify the name of the pvc
 # - name: name-of-pvc
+    # -- add pvc specific annotations
+#   annotations: {}
     # size is optional with a default value of "1Gi"
 #   size: 10Gi
     # -- accessModes is an optional list with a default list with the following slice: "ReadWriteOnce"
@@ -282,6 +323,19 @@ components:
       extraLabels: {}
       # foo: bar
 
+      # envSecret is a dictionary of environment variables set for every container in a pod, key: value
+      # envSecret: {}
+
+      # envConfigMap is a dictionary of environment variables set for every container in a pod, key: value
+      # envConfigMap: {}
+
+      # envFrom is a list of environment references
+      # envFrom: []
+      # - secretRef:
+      #     name: my-secret
+      # - configMapRef:
+      #     name: my-configmap
+
       # gatherMetrics is true: service get a label which triggers serviceMonitor to gather metrics
       gatherMetrics: false
 
@@ -395,6 +449,9 @@ components:
       # Restart policy for all containers within the pod. One of Always, OnFailure, Never. Default to Always.
       # restartPolicy: "Never"
 
+      # Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. Defaults to 30 seconds.
+      # terminationGracePeriodSeconds: 30
+
       # podSecurityContext holds pod-level security attributes and common container settings.
       # Some fields are also present in container.securityContext. Field values of containerSecurityContext take precedence over field values of podSecurityContext.
       # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
@@ -408,14 +465,22 @@ components:
 
       nodeSelector: {}
       tolerations: []
+      topologySpreadConstraints: {}
       affinity: {}
 
       # volumes is a list of volumes to be created as secret or configMap
       volumes: []
       #   -- name of the volume
-      # - name: generic-name
-      #   -- type can either be "secret", "configMap", "persistentVolumeClaim" or "emptyDir"
+      # - name: generic-name, existing-cm-name or existing-secret-name
+      #   -- type can either be "secret", "configMap", "persistentVolumeClaim", "emptyDir", "external" or "csi"
       #    type: "secret"
+      #   START ONLY FOR EXISTING CONFIGMAP AND EXISTING SECRET
+      #    existing: true # when mounting an existing ressource this has to be true
+      #    optional: true # false - prevents pod startup if the resource doesn't exist. See: https://kubernetes.io/docs/concepts/configuration/secret/#restriction-secret-must-exist
+      #    items:
+      #      - key: foo.txt
+      #        path: opt/foo.txt
+      #   END ONLY FOR EXISTING CONFIGMAP AND EXISTING SECRET
       #   START ONLY FOR SECRET or CONFIGMAP
       #   filePath is optional for specifying a filePath in the helm chart where the file is located.
       #    filePath: "files/xy.yml"
@@ -434,8 +499,35 @@ components:
       #   sizeLimit is the total amount of local storage required for this EmptyDir volume. Default is nil which means that the limit is undefined.
       #    sizeLimit: 100Mi
       #   END ONLY FOR EMPTYDIR
+      #   START ONLY FOR EXTERNAL
+      #   pvcName represents what name the external existing PVC has.
+      #    pvcName: "foo"
+      #   readOnly will force the ReadOnly setting in VolumeMounts. Comment out for using default (false)
+      #    readOnly: true
+      #   END ONLY FOR EXTERNAL
+      #   START ONLY FOR CSI
+      #   driver is the name of the CSI driver that handles this volume. Consult with your admin for the correct name as registered in the cluster.
+      #    driver: "foo"
+      #   readOnly will force the ReadOnly setting in VolumeMounts. Comment out for using default (false)
+      #    readOnly: true
+      #   volumeAttributes represents the arbitrary volume driver attributes.
+      #    volumeAttributes:
+      #      foo: "bar"
+      #   END ONLY FOR CSI
       # end pod
 
+      # hostAliases defines host names for IP addresses
+      # see also https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/#adding-additional-entries-with-hostaliases
+      # hostAliases: {}
+      # - ip: "127.0.0.1"
+      #   hostnames:
+      #   - "foo.local"
+      #   - "bar.local"
+      # - ip: "10.1.2.3"
+      #   hostnames:
+      #   - "foo.remote"
+      #   - "bar.remote"
+
       # start containers
       # dictionary of containers in a pod
       containers: {}
@@ -482,12 +574,24 @@ components:
           # You can define environment variables as map
           #  foo: bar
 
-          # envSecret is a dictionary of environment variables, key: value
+          # envSecret is a dictionary of environment variables set for the current container, key: value
           # envSecret: {}
 
-          # envConfigMap is a dictionary of environment variables, key: value
+          # envConfigMap is a dictionary of environment variables set for the current container, key: value
           # envConfigMap: {}
 
+          # envFrom is a list of environment references
+          # envFrom: []
+          # - secretRef:
+          #     name: my-secret
+          # - configMapRef:
+          #     name: my-configmap
+
+          # configFilesDefaultMode sets permissions for all configFiles mounted.
+          # See  'pod.spec.volumes.configMap.defaultMode' or 'pod.spec.volumes.secret.defaultMode' for more information
+          # Comment out for using default (0644)
+          # configFilesDefaultMode: 0644
+
           # configFiles is a dictionary of arbitrary config files in the structure below
           # format has to be "key=value", "yaml" or "simple". Default: "key=value"
           # secret is optional for specifying if file should be created as a Secret (= true) or ConfigMap (= false or not specified)
diff --git a/charts/crowd/Chart.yaml b/charts/crowd/Chart.yaml
index d9e533f..3d6dcda 100644
--- a/charts/crowd/Chart.yaml
+++ b/charts/crowd/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: crowd
 description: Manage users from multiple directories - Active Directory, LDAP, OpenLDAP or Microsoft Azure AD - and control application authentication permissions in one single location
 type: application
-version: 0.5.0
+version: 0.5.1
 appVersion: 4.2.3
 keywords:
   - atlassian
diff --git a/charts/crowd/README.md b/charts/crowd/README.md
index fd2385e..54d3f1a 100644
--- a/charts/crowd/README.md
+++ b/charts/crowd/README.md
@@ -2,7 +2,7 @@
 
 > **:exclamation: This Helm Chart is deprecated!**
 
-![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.5.1](https://img.shields.io/badge/Version-0.5.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Manage users from multiple directories - Active Directory, LDAP, OpenLDAP or Microsoft Azure AD - and control application authentication permissions in one single location
 
diff --git a/charts/crowd/templates/_crowd.tpl b/charts/crowd/templates/_crowd.tpl
index caea647..a04cc8e 100644
--- a/charts/crowd/templates/_crowd.tpl
+++ b/charts/crowd/templates/_crowd.tpl
@@ -36,14 +36,14 @@ Crowd Home
   Crowd JVM Arguments
 */}}
 {{- define "crowd.jvm_args" -}}
-{{ if $.Values.crowd.jvm_args }}{{- include "lib.utils.strings.stringify" (dict "list" $.Values.crowd.jvm_args "delimiter" "  " "context" $) }}{{- end }} {{ include "bedag-lib.utils.helpers.javaProxies" (dict "proxy" $.Values.proxy "context" $) }}
+{{ if $.Values.crowd.jvm_args }}{{- include "lib.utils.strings.stringify" (dict "list" $.Values.crowd.jvm_args "delimiter" " " "context" $) }}{{- end }} {{ include "bedag-lib.utils.helpers.javaProxies" (dict "proxy" $.Values.proxy "context" $) }}
 {{- end -}}
 
 {{/*
   Crowd Catalina Options
 */}}
 {{- define "crowd.catalina_opts" -}}
-{{ if $.Values.crowd.cluster.enabled }}{{ if $.Values.crowd.cluster.nodeName }}-Dcluster.node.name="$POD_NAME"{{ end }}{{ end }}{{ if $.Values.crowd.catalina_opts }}{{- include "lib.utils.strings.stringify" (dict "list" $.Values.crowd.catalina_opts "delimiter" "  " "context" $) }}{{- end }}
+{{ if $.Values.crowd.cluster.enabled }}{{ if $.Values.crowd.cluster.nodeName }}-Dcluster.node.name="$POD_NAME"{{ end }}{{ end }}{{ if $.Values.crowd.catalina_opts }}{{- include "lib.utils.strings.stringify" (dict "list" $.Values.crowd.catalina_opts "delimiter" " " "context" $) }}{{- end }}
 {{- end -}}
 
 
diff --git a/charts/e2g/Chart.yaml b/charts/e2g/Chart.yaml
index 4cd7327..27a3722 100644
--- a/charts/e2g/Chart.yaml
+++ b/charts/e2g/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: e2g
 description: "e2guardian Chart"
 type: application
-version: 1.2.3
+version: 1.2.4
 appVersion: "5.4"
 icon: "http://e2guardian.org/cms/images/banners/logo-guardian.png"
 home: "https://github.com/e2guardian/e2guardian/"
diff --git a/charts/e2g/README.md b/charts/e2g/README.md
index 35c0185..ea45eed 100644
--- a/charts/e2g/README.md
+++ b/charts/e2g/README.md
@@ -1,6 +1,6 @@
 # E2guardian
 
-![Version: 1.2.3](https://img.shields.io/badge/Version-1.2.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 1.2.4](https://img.shields.io/badge/Version-1.2.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 e2guardian Chart
 
diff --git a/charts/e2g/templates/bundle.yaml b/charts/e2g/templates/bundle.yaml
index 76634ea..8c7bcfe 100644
--- a/charts/e2g/templates/bundle.yaml
+++ b/charts/e2g/templates/bundle.yaml
@@ -48,7 +48,7 @@ resources:
     {{- toYaml $.Values.extraResources | nindent 2 }}
   {{- end }}
 
-  {{- if  $.Values.e2g.config }}
+  {{- if $.Values.e2g.config }}
   - type: "raw"
     manifest: |
       apiVersion: v1
@@ -88,7 +88,7 @@ resources:
           {{ $e | nindent 10 }}
     {{- end -}}
   {{- end -}}
-  {{- if  $.Values.e2g.filtergroups }}
+  {{- if $.Values.e2g.filtergroups }}
   - type: "raw"
     manifest: |
       apiVersion: v1
diff --git a/charts/e2g/templates/e2g.tpl b/charts/e2g/templates/e2g.tpl
index a99c921..42fab74 100644
--- a/charts/e2g/templates/e2g.tpl
+++ b/charts/e2g/templates/e2g.tpl
@@ -16,22 +16,22 @@ limitations under the License.
 */}}
 {{- define "overwrite" -}}
 volumes:
-  {{- if $.Values.e2g.config  }}
+  {{- if $.Values.e2g.config }}
 - name: "e2g-config"
   configMap:
     name: e2g-config
   {{- end }}
-  {{- if $.Values.e2g.story  }}
+  {{- if $.Values.e2g.story }}
 - name: "e2g-story"
   configMap:
     name: e2g-story
   {{- end }}
-  {{- if $.Values.e2g.lists  }}
+  {{- if $.Values.e2g.lists }}
 - name: "e2g-lists"
   configMap:
     name: e2g-lists
   {{- end }}
-  {{- if $.Values.e2g.filtergroups  }}
+  {{- if $.Values.e2g.filtergroups }}
 - name: "e2g-filtergroups"
   configMap:
     name: e2g-filtergroups
@@ -63,13 +63,13 @@ volumeMounts:
   subPath: e2guardian.conf
   {{- end }}
   {{ with $.Values.e2g.filtergroups }}
-    {{- range  . }}
+    {{- range . }}
 - mountPath: /usr/local/e2guardian/etc/e2guardian/e2guardianf{{ .id }}.conf
   name: e2g-filtergroups
   subPath: e2guardianf{{ .id }}.conf
     {{- end }}
   {{- end }}
-  {{- if or ($.Values.e2g.config) ($.Values.e2g.story)  ($.Values.e2g.lists) ($.Values.e2g.filtergroups) }}
+  {{- if or ($.Values.e2g.config) ($.Values.e2g.story) ($.Values.e2g.lists) ($.Values.e2g.filtergroups) }}
 podAnnotations:
   checksum/config: {{ tpl (toYaml .Values.e2g) . | sha256sum }}
   {{- end }}
diff --git a/charts/kafdrop/Chart.yaml b/charts/kafdrop/Chart.yaml
index babd577..0745517 100644
--- a/charts/kafdrop/Chart.yaml
+++ b/charts/kafdrop/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: kafdrop
 description: Unofficial Helm Chart for Kafdrop
-version: 0.3.0
+version: 0.3.1
 appVersion: 3.27.0
 type: application
 home: https://github.com/obsidiandynamics/kafdrop
diff --git a/charts/kafdrop/README.md b/charts/kafdrop/README.md
index a1af06f..9fd97d4 100644
--- a/charts/kafdrop/README.md
+++ b/charts/kafdrop/README.md
@@ -2,7 +2,7 @@
 
 > **:exclamation: This Helm Chart is deprecated!**
 
-![Version: 0.3.0](https://img.shields.io/badge/Version-0.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.3.1](https://img.shields.io/badge/Version-0.3.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Unofficial Helm Chart for Kafdrop
 
diff --git a/charts/kafdrop/templates/bundle.yaml b/charts/kafdrop/templates/bundle.yaml
index f096692..21d7605 100644
--- a/charts/kafdrop/templates/bundle.yaml
+++ b/charts/kafdrop/templates/bundle.yaml
@@ -39,7 +39,7 @@ resources:
 
       environment: {{- include "kafdrop.configuration" $ | nindent 8 }}
         {{- if $.Values.deployment.environment }}
-          {{ include "lib.utils.lists.exceptionList" (dict "list" $.Values.deployment.environment  "exceptions" (list "KAFKA_BROKERCONNECT" "JVM_OPTS")) | nindent 8 }}
+          {{ include "lib.utils.lists.exceptionList" (dict "list" $.Values.deployment.environment "exceptions" (list "KAFKA_BROKERCONNECT" "JVM_OPTS")) | nindent 8 }}
         {{- end }}
 
       {{/*
diff --git a/charts/manifests/Chart.yaml b/charts/manifests/Chart.yaml
index d79cc78..15e3e62 100644
--- a/charts/manifests/Chart.yaml
+++ b/charts/manifests/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: manifests
 description: "Bedag's Manifest chart. Library full of basic kubernetes manifests."
 type: library
-version: 1.0.0
+version: 1.0.1
 icon: "https://www.bedag.ch/wGlobal/wGlobal/layout/images/logo.svg"
 keywords:
 - Bedag
diff --git a/charts/manifests/README.md b/charts/manifests/README.md
index 1d0c325..4c23e94 100644
--- a/charts/manifests/README.md
+++ b/charts/manifests/README.md
@@ -1,7 +1,7 @@
 # Manifests Library
 > **:exclamation: This Helm Chart is deprecated!**
 
-![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
+![Version: 1.0.1](https://img.shields.io/badge/Version-1.0.1-informational?style=flat-square) ![Type: library](https://img.shields.io/badge/Type-library-informational?style=flat-square)
 
 This library's purpose is to have more flexibility as chart author but at the same time have kubernetes manifests managed in a central library. This way you can avoid big surprises when Kubernetes has breaking changes in any of their APIs. Currently we support a base set of resources. Resources may be added as soon as we see or get a request that there's a need for it. This chart is still under development and testing, since it's rather complex. Feel free to use it. Our goal is to get it as reliable as possible.
 
diff --git a/charts/manifests/templates/manifests/_cronjob.tpl b/charts/manifests/templates/manifests/_cronjob.tpl
index d44bb44..1e1b7cc 100644
--- a/charts/manifests/templates/manifests/_cronjob.tpl
+++ b/charts/manifests/templates/manifests/_cronjob.tpl
@@ -28,7 +28,7 @@ apiVersion: {{ $cronjob.apiVersion }}
 apiVersion: batch/v1beta1
         {{- end }}
 metadata:
-  name:  {{ include "bedag-lib.utils.common.fullname" . }}
+  name: {{ include "bedag-lib.utils.common.fullname" . }}
   labels: {{- include "bedag-lib.utils.common.labels" (dict "labels" $cronjob.labels "context" $context)| nindent 4 }}
         {{- if $cronjob.annotations }}
   annotations:
diff --git a/charts/manifests/templates/manifests/_deployment.tpl b/charts/manifests/templates/manifests/_deployment.tpl
index 6f55279..c964b71 100644
--- a/charts/manifests/templates/manifests/_deployment.tpl
+++ b/charts/manifests/templates/manifests/_deployment.tpl
@@ -31,7 +31,7 @@ metadata:
   labels: {{- include "bedag-lib.utils.common.labels" (dict "labels" $deployment.labels "context" $context)| nindent 4 }}
 spec:
       {{- with $deployment.strategy }}
-  strategy: {{ toYaml . |  nindent 4 }}
+  strategy: {{ toYaml . | nindent 4 }}
       {{- end }}
   replicas: {{ default "1" $deployment.replicaCount }}
   selector:
diff --git a/charts/manifests/templates/manifests/_horizontalPodAutoscaler.tpl b/charts/manifests/templates/manifests/_horizontalPodAutoscaler.tpl
index 8739aaa..12711ab 100644
--- a/charts/manifests/templates/manifests/_horizontalPodAutoscaler.tpl
+++ b/charts/manifests/templates/manifests/_horizontalPodAutoscaler.tpl
@@ -56,7 +56,7 @@ spec:
         {{- end }}
   scaleTargetRef:
         {{- if $hpa.scaleTargetRef }}
-          {{- toYaml $hpa.scaleTargetRef | nindent 4  }}
+          {{- toYaml $hpa.scaleTargetRef | nindent 4 }}
         {{- else }}
     apiVersion: apps/v1
     kind: Statefulset
diff --git a/charts/manifests/templates/manifests/_ingress.tpl b/charts/manifests/templates/manifests/_ingress.tpl
index e383b9f..eb37b9d 100644
--- a/charts/manifests/templates/manifests/_ingress.tpl
+++ b/charts/manifests/templates/manifests/_ingress.tpl
@@ -34,7 +34,7 @@ apiVersion: extensions/v1beta1
           {{- end }}
         {{- end }}
 metadata:
-  name:  {{ include "bedag-lib.utils.common.fullname" . }}
+  name: {{ include "bedag-lib.utils.common.fullname" . }}
   labels: {{- include "bedag-lib.utils.common.labels" (dict "labels" $ingress.labels "context" $context)| nindent 4 }}
         {{- if $ingress.annotations }}
   annotations:
diff --git a/charts/manifests/templates/manifests/_networkPolicy.tpl b/charts/manifests/templates/manifests/_networkPolicy.tpl
index dd7584e..b872674 100644
--- a/charts/manifests/templates/manifests/_networkPolicy.tpl
+++ b/charts/manifests/templates/manifests/_networkPolicy.tpl
@@ -28,7 +28,7 @@ apiVersion: {{ $networkPolicy.apiVersion }}
 apiVersion: networking.k8s.io/v1
         {{- end }}
 metadata:
-  name:  {{ include "bedag-lib.utils.common.fullname" . }}
+  name: {{ include "bedag-lib.utils.common.fullname" . }}
   labels: {{- include "bedag-lib.utils.common.labels" (dict "labels" $networkPolicy.labels "context" $context)| nindent 4 }}
 spec:
   podSelector:
diff --git a/charts/manifests/templates/manifests/templates/_containerTpl.tpl b/charts/manifests/templates/manifests/templates/_containerTpl.tpl
index 74ff9e9..eb79166 100644
--- a/charts/manifests/templates/manifests/templates/_containerTpl.tpl
+++ b/charts/manifests/templates/manifests/templates/_containerTpl.tpl
@@ -29,7 +29,7 @@ securityContext: {{- include "lib.utils.strings.template" (dict "value" . "conte
 resources: {{- include "lib.utils.strings.template" (dict "value" . "context" $context) | nindent 2 }}
     {{- end }}
     {{- if $values.containerFields }}
-      {{- include "lib.utils.strings.template" (dict "value" $values.containerFields "context" $context)  | nindent 0 }}
+      {{- include "lib.utils.strings.template" (dict "value" $values.containerFields "context" $context) | nindent 0 }}
     {{- end }}
 env: {{- include "lib.utils.extras.environment" $context | nindent 2 }}
     {{- if and $values.environment (kindIs "slice" $values.environment) }}
@@ -64,7 +64,7 @@ args: {{- include "lib.utils.strings.template" (dict "value" $values.args "conte
 livenessProbe: {{ include "lib.utils.strings.template" (dict "value" $values.livenessProbe "context" $context) | nindent 2 }}
     {{- end }}
     {{- with $values.readinessProbe }}
-readinessProbe: {{ include "lib.utils.strings.template" (dict "value" $values.readinessProbe "context" $context)  | nindent 2 }}
+readinessProbe: {{ include "lib.utils.strings.template" (dict "value" $values.readinessProbe "context" $context) | nindent 2 }}
     {{- end }}
     {{- if $values.startupProbe }}
 startupProbe: {{ include "lib.utils.strings.template" (dict "value" $values.startupProbe "context" $context) | nindent 2 }}
diff --git a/charts/manifests/templates/presets/components/_jmxexporter.tpl b/charts/manifests/templates/presets/components/_jmxexporter.tpl
index fc3fd47..9bdf0e6 100644
--- a/charts/manifests/templates/presets/components/_jmxexporter.tpl
+++ b/charts/manifests/templates/presets/components/_jmxexporter.tpl
@@ -32,7 +32,7 @@ ports:
     protocol: TCP
       {{- if $.values.config }}
 volumes:
-  - name: "{{  $name }}-config"
+  - name: "{{ $name }}-config"
     configMap:
       name: {{ include "bedag-lib.utils.common.fullname" (dict "name" $name "context" $.context) }}
       {{- end }}
diff --git a/charts/manifests/templates/utils/_values.tpl b/charts/manifests/templates/utils/_values.tpl
index 52ae121..0e1ee8b 100644
--- a/charts/manifests/templates/utils/_values.tpl
+++ b/charts/manifests/templates/utils/_values.tpl
@@ -26,7 +26,7 @@ limitations under the License.
         {{- else }}
           {{- $resource = cat "bedag-lib.presets.values." ($.Values.doc.preset | lower) | nospace }}
         {{- end }}
-        {{- $path :=  (default "" $.Values.doc.path) }}
+        {{- $path := (default "" $.Values.doc.path) }}
         {{- if not (hasSuffix "." $path) }}
           {{- $path = (cat $path "." | nospace) }}
         {{- end }}
diff --git a/charts/manifests/templates/values/manifests/_horizontalPodAutoscaler.yaml b/charts/manifests/templates/values/manifests/_horizontalPodAutoscaler.yaml
index 1ebedd5..d583472 100644
--- a/charts/manifests/templates/values/manifests/_horizontalPodAutoscaler.yaml
+++ b/charts/manifests/templates/values/manifests/_horizontalPodAutoscaler.yaml
@@ -8,7 +8,7 @@
 {{ $_.parentKey }}:
 
   ## Horizontal Pod Autoscaler Enable
-  # {{ $_.path }}enabled --  Enable HPA resource
+  # {{ $_.path }}enabled -- Enable HPA resource
   enabled: true
 
   ## Horizontal Pod Autoscaler API version
diff --git a/charts/manifests/templates/values/manifests/templates/_containerTpl.yaml b/charts/manifests/templates/values/manifests/templates/_containerTpl.yaml
index dc3d748..1f855a8 100644
--- a/charts/manifests/templates/values/manifests/templates/_containerTpl.yaml
+++ b/charts/manifests/templates/values/manifests/templates/_containerTpl.yaml
@@ -1,6 +1,6 @@
 {{- define "bedag-lib.values.template.container" -}}
   {{- $context := (default $ .context) }}
-  {{- $_ := dict  "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
+  {{- $_ := dict "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
 
 #
 ## -- Container
diff --git a/charts/manifests/templates/values/manifests/templates/_jobTpl.yaml b/charts/manifests/templates/values/manifests/templates/_jobTpl.yaml
index 8ea273e..7463a40 100644
--- a/charts/manifests/templates/values/manifests/templates/_jobTpl.yaml
+++ b/charts/manifests/templates/values/manifests/templates/_jobTpl.yaml
@@ -1,6 +1,6 @@
 {{- define "bedag-lib.values.template.job" -}}
   {{- $context := (default $ .context) }}
-  {{- $_ := dict  "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
+  {{- $_ := dict "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
 ## Job activeDeadlineSeconds
 # {{ $_.path }}activeDeadlineSeconds -- (int) Specifies the duration in seconds relative to the startTime that the job may be active before the system tries to terminate it; value must be positive integer.
 activeDeadlineSeconds: {{ default "" $_.data.activeDeadlineSeconds }}
diff --git a/charts/manifests/templates/values/manifests/templates/_podTpl.yaml b/charts/manifests/templates/values/manifests/templates/_podTpl.yaml
index c7115a7..32e06e1 100644
--- a/charts/manifests/templates/values/manifests/templates/_podTpl.yaml
+++ b/charts/manifests/templates/values/manifests/templates/_podTpl.yaml
@@ -1,6 +1,6 @@
 {{- define "bedag-lib.values.template.pod" -}}
   {{- $context := (default $ .context) }}
-  {{- $_ := dict  "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
+  {{- $_ := dict "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
 ## Image Pull Secrets
 # {{ $_.path }}imagePullSecrets -- Define [ImagePullSecrets](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). Will be overwritten if set by global variable.
 imagePullSecrets: []
diff --git a/charts/manifests/templates/values/manifests/templates/_pvcTpl.yaml b/charts/manifests/templates/values/manifests/templates/_pvcTpl.yaml
index 8a024ce..c556a41 100644
--- a/charts/manifests/templates/values/manifests/templates/_pvcTpl.yaml
+++ b/charts/manifests/templates/values/manifests/templates/_pvcTpl.yaml
@@ -1,6 +1,6 @@
 {{- define "bedag-lib.values.template.pvc" -}}
   {{- $context := (default $ .context) }}
-  {{- $_ := dict  "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
+  {{- $_ := dict "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
 ## Persistent Volume Claim Labels
 # {{ $_.path }}labels -- Merges given labels with common labels
 labels: {}
diff --git a/charts/manifests/templates/values/presets/components/_jmxexporter.yaml b/charts/manifests/templates/values/presets/components/_jmxexporter.yaml
index dc5fe32..7191ffc 100644
--- a/charts/manifests/templates/values/presets/components/_jmxexporter.yaml
+++ b/charts/manifests/templates/values/presets/components/_jmxexporter.yaml
@@ -1,6 +1,6 @@
 {{- define "bedag-lib.presets.values.jmxexporter" -}}
   {{- $context := (default $ .context) }}
-  {{- $_ := dict  "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
+  {{- $_ := dict "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
 ## Enable JMX Exporter
 # {{ $_.path }}enabled -- Enables [JMX Exporter](https://github.com/bitnami/bitnami-docker-jmx-exporter) as Sidecar
 enabled: false
diff --git a/charts/manifests/templates/values/presets/containers/_permissions.yaml b/charts/manifests/templates/values/presets/containers/_permissions.yaml
index da98eb9..63f6e0b 100644
--- a/charts/manifests/templates/values/presets/containers/_permissions.yaml
+++ b/charts/manifests/templates/values/presets/containers/_permissions.yaml
@@ -1,6 +1,6 @@
 {{- define "bedag-lib.presets.values.permissions" -}}
   {{- $context := (default $ .context) }}
-  {{- $_ := dict  "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
+  {{- $_ := dict "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
 ## Volume Permission Enable
 # {{ $_.path }}enabled -- Enables Volume Permissions
 enabled: false
diff --git a/charts/manifests/templates/values/presets/containers/_readiness.yaml b/charts/manifests/templates/values/presets/containers/_readiness.yaml
index d3a9013..6eb2d80 100644
--- a/charts/manifests/templates/values/presets/containers/_readiness.yaml
+++ b/charts/manifests/templates/values/presets/containers/_readiness.yaml
@@ -1,6 +1,6 @@
 {{- define "bedag-lib.presets.values.readiness" -}}
   {{- $context := (default $ .context) }}
-  {{- $_ := dict  "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
+  {{- $_ := dict "path" (default $context.path .path) "context" $context "data" (default dict .data) "minimal" (default false .minimal) }}
 ## Readiness Enable
 # {{ $_.path }}enabled -- Enables Readiness Check
 enabled: false
diff --git a/charts/raw/Chart.yaml b/charts/raw/Chart.yaml
index 3daf032..d3fa6f2 100644
--- a/charts/raw/Chart.yaml
+++ b/charts/raw/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: raw
 description: "Render raw kubernetes manifests managed by a helm release"
 type: application
-version: 2.0.1
+version: 2.0.2
 appVersion: 1.0.0
 icon: "https://www.bedag.ch/wGlobal/wGlobal/layout/images/logo.svg"
 home: "https://github.com/bedag/helm-charts/tree/master/charts/raw"
diff --git a/charts/raw/README.md b/charts/raw/README.md
index 36c5d80..d892359 100644
--- a/charts/raw/README.md
+++ b/charts/raw/README.md
@@ -1,6 +1,6 @@
 # Raw
 
-![Version: 2.0.1](https://img.shields.io/badge/Version-2.0.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 2.0.2](https://img.shields.io/badge/Version-2.0.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Render raw kubernetes manifests managed by a helm release
 
diff --git a/charts/raw/templates/resources.yaml b/charts/raw/templates/resources.yaml
index ab930e6..9c035f6 100644
--- a/charts/raw/templates/resources.yaml
+++ b/charts/raw/templates/resources.yaml
@@ -21,6 +21,6 @@ limitations under the License.
 ---{{- toYaml (merge . $base) | nindent 0 }}
   {{- end }}
   {{- range $.Values.templates }}
----{{- (tpl . $)  | nindent 0 }}
+---{{- (tpl . $) | nindent 0 }}
   {{- end }}
 {{- end -}}
diff --git a/charts/vcluster/Chart.yaml b/charts/vcluster/Chart.yaml
index ccb067e..6d8828b 100644
--- a/charts/vcluster/Chart.yaml
+++ b/charts/vcluster/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: vcluster
 description: Virtual Kubernetes Cluster
 type: application
-version: 0.5.1
+version: 0.16.5
 appVersion: 0.1.0
 keywords:
   - vcluster
@@ -13,7 +13,3 @@ home: https://artifacthub.io/packages/helm/kvaps/kubernetes
 maintainers:
   - name: "Bedag Informatik AG"
     email: sre@bedag.ch
-dependencies:
-  - name: common
-    version: 2.2.4
-    repository: https://charts.bitnami.com/bitnami
diff --git a/charts/vcluster/README.md b/charts/vcluster/README.md
index 7e0e90c..7748c43 100644
--- a/charts/vcluster/README.md
+++ b/charts/vcluster/README.md
@@ -2,7 +2,7 @@
 
 __This Chart is under active development! We try to improve documentation and values consistency over time__
 
-![Version: 0.5.1](https://img.shields.io/badge/Version-0.5.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.16.5](https://img.shields.io/badge/Version-0.16.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Virtual Kubernetes Cluster
 
@@ -14,12 +14,6 @@ Virtual Kubernetes Cluster
 | ---- | ------ | --- |
 | Bedag Informatik AG | <sre@bedag.ch> |  |
 
-## Requirements
-
-| Repository | Name | Version |
-|------------|------|---------|
-| https://charts.bitnami.com/bitnami | common | 2.2.4 |
-
 # Major Changes
 
 Major Changes to functions are documented with the version affected. **Before upgrading the dependency version, check this section out!**
@@ -108,9 +102,11 @@ Global Values
 | global.components.workloads.topologySpreadConstraints | list | `[]` | TopologySpreadConstraints for all workloads (Overwrites all workloads topologySpreadConstraints) |
 | global.proxy.host | string | `""` | Proxy Host |
 | global.proxy.no_proxy | string | `"10.0.0.0/8"` | No Proxy Hosts |
-| global.registry.creds.password | string | `""` | Registry Password |
-| global.registry.creds.username | string | `""` | Registry Username |
-| global.registry.endpoint | string | `""` | Registry Endpoint |
+| global.registries.primary | object | `{"creds":{"password":"","username":""},"endpoint":""}` | Default Registry (used for kubeadm, regcred secret etc.) |
+| global.registries.primary.creds.password | string | `""` | Registry Password |
+| global.registries.primary.creds.username | string | `""` | Registry Username |
+| global.registries.primary.endpoint | string | `""` | Registry Endpoint |
+| global.registries.secondaries | object | `{}` | Additional Registries (used in regcred secret) |
 | global.storageClassName | string | `""` | StorageClassName for all persistent volumes |
 
 ## Utilities Values
@@ -130,17 +126,25 @@ We use a lifecycle Job/Cronjob to manage certain configurations within the vclus
 |-----|------|---------|-------------|
 | lifecycle.argocd.namespace | string | `"argocd"` | Installation namespace of ArgoCD |
 | lifecycle.argocd.rbac | bool | `true` | Creates required rbac in argoCD namespace to create cluster secrets |
+| lifecycle.cilium.bgpControlPlane | object | `{"enabled":true}` | Enable BGP Control Plane feature |
+| lifecycle.cilium.devices | string | `""` | Specify which network interfaces can run the eBPF datapath |
 | lifecycle.cilium.enabled | bool | `true` | Install Cilium CNI |
 | lifecycle.cilium.on_install | bool | `true` | Install only on chart install (First install) |
 | lifecycle.cilium.version | string | `"1.9.18"` | Cilium version |
 | lifecycle.cleanup.annotations | object | `{"helm.sh/hook":"pre-delete","helm.sh/hook-delete-policy":"before-hook-creation"}` | Job Annotations |
 | lifecycle.cleanup.enabled | bool | `false` | Enable/Disable Cleanup |
 | lifecycle.cleanup.labels | object | `{}` | Job Labels |
-| lifecycle.current.cleanupScript | string | `nil` | Additional configuration script for the vcluster during cleanup (supports templating) |
 | lifecycle.current.extraManifests | object | See values.yaml | These manifests will be applied inside the cluster (supports templating) |
 | lifecycle.current.extraManifestsOnInstall | object | See values.yaml | These manifests will be applied inside the cluster, but only on $.Release.Install and wont be touched again (supports templating) |
-| lifecycle.current.setupScript | string | `nil` | Additional configuration script for the current cluster (supports templating) |
 | lifecycle.jobs.affinity | object | `{}` | Affinity |
+| lifecycle.jobs.connectivity.image.digest | string | `""` | Image Digest |
+| lifecycle.jobs.connectivity.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| lifecycle.jobs.connectivity.image.pullSecrets | list | `[]` | Image pull Secrets |
+| lifecycle.jobs.connectivity.image.registry | string | `"ghcr.io"` | Image registry |
+| lifecycle.jobs.connectivity.image.repository | string | `"kvaps/kubernetes-tools"` | Image repository |
+| lifecycle.jobs.connectivity.image.tag | string | `"v0.13.4"` | Image tag |
+| lifecycle.jobs.connectivity.resources | object | `{}` | Resources configuration |
+| lifecycle.jobs.connectivity.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"privileged":false,"runAsGroup":20000,"runAsUser":20000}` | Container Security Context |
 | lifecycle.jobs.extraEnv | list | `[]` | Additional Pod Environment variables |
 | lifecycle.jobs.extraVolumeMounts | list | `[]` | Additional Pod VolumeMounts |
 | lifecycle.jobs.extraVolumes | list | `[]` | Additional Pod Volumes |
@@ -164,10 +168,8 @@ We use a lifecycle Job/Cronjob to manage certain configurations within the vclus
 | lifecycle.setup.schedule | string | `"0 0 1 */6 *"` | Cronjob Schedule |
 | lifecycle.setup.successfulJobsHistoryLimit | int | `3` | Cronjob successful jobs history limit |
 | lifecycle.setup.ttlSecondsAfterFinished | int | `120` | ttlSecondsAfterFinished for setup |
-| lifecycle.vcluster.cleanupScript | string | `nil` | Additional configuration script for the vcluster during cleanup (supports templating) |
-| lifecycle.vcluster.extraManifests | object | See values.yaml | These manifests will be applied inside the vcluster (supports templating) |
-| lifecycle.vcluster.extraManifestsOnInstall | object | See values.yaml | These manifests will be applied inside the vcluster, but only on $.Release.Install and wont be touched again (supports templating) |
-| lifecycle.vcluster.setupScript | string | `nil` | Additional configuration script for the vcluster during reconciler (supports templating) |
+| lifecycle.vcluster.extraOnlineManifests | list | `[]` | List of URLs which will be applied inside the vcluster (supports templating) |
+| lifecycle.vcluster.extraOnlineManifestsOnInstall | list | `[]` | List of URLs which will be applied inside the vcluster, but only on $.Release.Install and wont be touched again (supports templating) |
 
 ## Machine Values
 
@@ -185,10 +187,25 @@ Available Values for the [Machine Controller Component](#machine-controller). Th
 | machine.autoscaling.targetMemoryUtilizationPercentage | string | `nil` | Benchmark Memory Usage |
 | machine.component.ensureManifestsOnStartup | bool | `true` | Ensure all components manifests are present on controller start (as initContainer) |
 | machine.component.removeManifestsOnDisable | bool | `true` | Remove all manifests on disable in the vcluster (**Attention**: When crds are deleted all crs will be deleted as well) |
+| machine.connectivity.image.digest | string | `""` | Image Digest |
+| machine.connectivity.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| machine.connectivity.image.pullSecrets | list | `[]` | Image pull Secrets |
+| machine.connectivity.image.registry | string | `"ghcr.io"` | Image registry |
+| machine.connectivity.image.repository | string | `"kvaps/kubernetes-tools"` | Image repository |
+| machine.connectivity.image.tag | string | `"v0.13.4"` | Image tag |
+| machine.connectivity.resources | object | `{}` | Resources configuration |
+| machine.connectivity.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"privileged":false,"runAsGroup":20000,"runAsUser":20000}` | Container Security Context |
 | machine.enabled | bool | `true` | Enable Machine-Controller Component |
 | machine.imagePullSecrets | list | `[]` | Image pull Secrets |
-| machine.kubelet.featureGates | list | `[]` | FeatureGates for kubelet |
 | machine.labels | object | `{}` | Labels for Workload |
+| machine.manifest.image.digest | string | `""` | Image Digest |
+| machine.manifest.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| machine.manifest.image.pullSecrets | list | `[]` | Image pull Secrets |
+| machine.manifest.image.registry | string | `"ghcr.io"` | Image registry |
+| machine.manifest.image.repository | string | `"kvaps/kubernetes-tools"` | Image repository |
+| machine.manifest.image.tag | string | `"v0.13.4"` | Image tag |
+| machine.manifest.resources | object | `{}` | Resources configuration |
+| machine.manifest.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"privileged":false,"runAsGroup":20000,"runAsUser":20000}` | Container Security Context |
 | machine.metrics.service.annotations | object | `{}` | Service Annotations |
 | machine.metrics.service.labels | object | `{}` | Service Labels |
 | machine.metrics.serviceMonitor.annotations | object | `{}` | Assign additional Annotations |
@@ -203,18 +220,12 @@ Available Values for the [Machine Controller Component](#machine-controller). Th
 | machine.metrics.serviceMonitor.namespace | string | `""` | Install the ServiceMonitor into a different Namespace, as the monitoring stack one (default: the release one) |
 | machine.metrics.serviceMonitor.targetLabels | list | `[]` | Set targetLabels for the serviceMonitor |
 | machine.nodeSelector | object | `{}` | Node Selector |
-| machine.pause.image.digest | string | `""` | Image Digest |
-| machine.pause.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
-| machine.pause.image.registry | string | `""` | Image registry |
-| machine.pause.image.repository | string | `"pause"` | Image repository |
-| machine.pause.image.tag | string | `"3.5"` | Image tag |
 | machine.podAnnotations | object | `{}` | Pod Annotations |
 | machine.podDisruptionBudget | object | `{}` | Configure PodDisruptionBudget |
 | machine.podLabels | object | `{}` | Pod Labels |
 | machine.podSecurityContext | object | `{"enabled":true,"runAsNonRoot":false,"seccompProfile":{"type":"RuntimeDefault"}}` | Pod Security Context |
 | machine.priorityClassName | string | `""` | Pod PriorityClassName |
 | machine.replicaCount | int | `1` | Replicas for Admission Pods |
-| machine.runtime | string | `"containerd"` | Used Runtime |
 | machine.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
 | machine.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
 | machine.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
@@ -229,7 +240,7 @@ Available Values for the [Machine Controller Component](#machine-controller). Th
 ---
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| machine.controller.args | object | `{"join-cluster-timeout":"25m","node-csr-approver":true,"worker-count":10}` | Controller Command Arguments ([See Available](https://github.com/kubermatic/machine-controller/blob/main/cmd/machine-controller/main.go)) |
+| machine.controller.args | object | `{"join-cluster-timeout":"25m","log-debug":false,"log-format":"json","node-csr-approver":true,"worker-count":10}` | Controller Command Arguments ([See Available](https://github.com/kubermatic/machine-controller/blob/main/cmd/machine-controller/main.go)) |
 | machine.controller.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
 | machine.controller.envsFrom | list | `[]` | Extra environment variables from |
 | machine.controller.image.digest | string | `""` | Image Digest |
@@ -249,7 +260,7 @@ Available Values for the [Machine Controller Component](#machine-controller). Th
 ---
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| machine.admission.args | object | `{"v":4}` | Webhook Command Arguments ([See Available](https://github.com/kubermatic/machine-controller/blob/main/cmd/webhook/main.go)) |
+| machine.admission.args | object | `{"log-debug":false,"log-format":"json"}` | Webhook Command Arguments ([See Available](https://github.com/kubermatic/machine-controller/blob/main/cmd/webhook/main.go)) |
 | machine.admission.enabled | bool | `false` | Enable Admission Webhook Feature |
 | machine.admission.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
 | machine.admission.envsFrom | list | `[]` | Extra environment variables from |
@@ -276,7 +287,7 @@ Available Values for the [Machine Controller Component](#machine-controller). Th
 | machine.admission.volumeMounts | list | `[]` | Volume Mounts |
 | machine.admission.webhook.timeoutSeconds | int | `30` | Admission Webhook Timeout |
 | machine.admission.webhook.tls.dnsNames | list | `[]` | Additional DNS Names for ADmission certificate |
-| machine.admission.webhook.tls.ipAddresses | list | `[]` | Additional IP adresses for Admission certificate |
+| machine.admission.webhook.tls.ipAddresses | list | `[]` | Additional IP addresses for Admission certificate |
 | machine.admission.webhook.tls.name | string | `""` | Override the TLS Secret Name |
 
 ## OSM Values
@@ -298,9 +309,26 @@ Available Values for the [Operating System Manager](). The component consists of
 | osm.component.ensureManifestsOnStartup | bool | `true` | Ensure all components manifests are present on controller start (as initContainer) |
 | osm.component.manageCRDs | bool | `true` | Manage CRDs within the cluster |
 | osm.component.removeManifestsOnDisable | bool | `true` | Remove all manifests on disable in the vcluster (**Attention**: When crds are deleted all crs will be deleted as well) |
-| osm.enabled | bool | `false` | Enable Operating System Manager Component |
+| osm.connectivity.image.digest | string | `""` | Image Digest |
+| osm.connectivity.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| osm.connectivity.image.pullSecrets | list | `[]` | Image pull Secrets |
+| osm.connectivity.image.registry | string | `"ghcr.io"` | Image registry |
+| osm.connectivity.image.repository | string | `"kvaps/kubernetes-tools"` | Image repository |
+| osm.connectivity.image.tag | string | `"v0.13.4"` | Image tag |
+| osm.connectivity.resources | object | `{}` | Resources configuration |
+| osm.connectivity.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"privileged":false,"runAsGroup":20000,"runAsUser":20000}` | Container Security Context |
+| osm.enabled | bool | `true` | Enable Operating System Manager Component |
 | osm.imagePullSecrets | list | `[]` | Image pull Secrets |
+| osm.kubelet.featureGates | list | `[]` | FeatureGates for kubelet |
 | osm.labels | object | `{}` | Labels for Workload |
+| osm.manifest.image.digest | string | `""` | Image Digest |
+| osm.manifest.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| osm.manifest.image.pullSecrets | list | `[]` | Image pull Secrets |
+| osm.manifest.image.registry | string | `"ghcr.io"` | Image registry |
+| osm.manifest.image.repository | string | `"kvaps/kubernetes-tools"` | Image repository |
+| osm.manifest.image.tag | string | `"v0.13.5"` | Image tag |
+| osm.manifest.resources | object | `{}` | Resources configuration |
+| osm.manifest.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"privileged":false,"runAsGroup":20000,"runAsUser":20000}` | Container Security Context |
 | osm.metrics.enabled | bool | `true` | Enable Metrics |
 | osm.metrics.service.annotations | object | `{}` | Service Annotations |
 | osm.metrics.service.labels | object | `{}` | Service Labels |
@@ -316,12 +344,18 @@ Available Values for the [Operating System Manager](). The component consists of
 | osm.metrics.serviceMonitor.namespace | string | `""` | Install the ServiceMonitor into a different Namespace, as the monitoring stack one (default: the release one) |
 | osm.metrics.serviceMonitor.targetLabels | list | `[]` | Set targetLabels for the serviceMonitor |
 | osm.nodeSelector | object | `{}` | Node Selector |
+| osm.pause.image.digest | string | `""` | Image Digest |
+| osm.pause.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| osm.pause.image.registry | string | `""` | Image registry |
+| osm.pause.image.repository | string | `"pause"` | Image repository |
+| osm.pause.image.tag | string | `"3.5"` | Image tag |
 | osm.podAnnotations | object | `{}` | Pod Annotations |
 | osm.podDisruptionBudget | object | `{}` | Configure PodDisruptionBudget |
 | osm.podLabels | object | `{}` | Pod Labels |
 | osm.podSecurityContext | object | `{"enabled":true,"runAsNonRoot":false,"seccompProfile":{"type":"RuntimeDefault"}}` | Pod Security Context |
 | osm.priorityClassName | string | `""` | Pod PriorityClassName |
 | osm.replicaCount | int | `1` | Replicas for Admission Pods |
+| osm.runtime | string | `"containerd"` | Used Runtime |
 | osm.serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
 | osm.serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
 | osm.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
@@ -336,7 +370,7 @@ Available Values for the [Operating System Manager](). The component consists of
 ---
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| osm.controller.args | object | `{"worker-count":10}` | Controller Command Arguments ([See Available](https://github.com/kubermatic/operating-system-manager/blob/main/cmd/osm-controller/main.go)) |
+| osm.controller.args | object | `{"log-debug":false,"log-format":"json","worker-count":10}` | Controller Command Arguments ([See Available](https://github.com/kubermatic/operating-system-manager/blob/main/cmd/osm-controller/main.go)) |
 | osm.controller.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
 | osm.controller.envsFrom | list | `[]` | Extra environment variables from |
 | osm.controller.image.digest | string | `""` | Image Digest |
@@ -356,8 +390,8 @@ Available Values for the [Operating System Manager](). The component consists of
 ---
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| osm.admission.args | object | `{"v":4}` | Webhook Command Arguments ([See Available](https://github.com/kubermatic/operating-system-manager/blob/main/cmd/webhook/main.go)) |
-| osm.admission.enabled | bool | `true` | Enable Admission Webhook |
+| osm.admission.args | object | `{"log-debug":false,"log-format":"json"}` | Webhook Command Arguments ([See Available](https://github.com/kubermatic/operating-system-manager/blob/main/cmd/webhook/main.go)) |
+| osm.admission.enabled | bool | `false` | Enable Admission Webhook |
 | osm.admission.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
 | osm.admission.envsFrom | list | `[]` | Extra environment variables from |
 | osm.admission.expose | string | `""` | How to expose the admission service to be reachable from the vcluster. Can be `ingress` or `loadbalancer |
@@ -383,7 +417,7 @@ Available Values for the [Operating System Manager](). The component consists of
 | osm.admission.volumeMounts | list | `[]` | Pod VolumeMounts |
 | osm.admission.webhook.timeoutSeconds | int | `30` | Admission Webhook Timeout |
 | osm.admission.webhook.tls.dnsNames | list | `[]` | Additional DNS Names for ADmission certificate |
-| osm.admission.webhook.tls.ipAddresses | list | `[]` | Additional IP adresses for Admission certificate |
+| osm.admission.webhook.tls.ipAddresses | list | `[]` | Additional IP addresses for Admission certificate |
 | osm.admission.webhook.tls.name | string | `""` | Override the TLS Secret Name |
 
 ## Kubernetes Values
@@ -393,8 +427,7 @@ Available Values for the [Operating System Manager](). The component consists of
 Available Values for the [Kubernetes component](#kubernetes).
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| kubernetes.component.removeManifestsOnDisable | bool | `true` | Remove all manifests on disable in the vcluster (**Attention**: When crds are deleted all crs will be deleted as well) |
-| kubernetes.controlPlane | object | `{"endpoint":null}` | ControlerPlaneEndpoint |
+| kubernetes.controlPlane | object | `{"endpoint":null}` | ControllerPlaneEndpoint |
 | kubernetes.controlPlane.endpoint | string | `nil` | Endpoint for ControlPlane (eg `128.1314.1234.4242:6443`). If not set, the vcluster will try to find the endpoint automatically. |
 | kubernetes.enabled | bool | `true` | Enable Kubernetes Component |
 | kubernetes.kubeProxy.enabled | bool | `true` | Install kube-proxy via KubeADM. If disabled, the cilium kube-proxy replacement will be used |
@@ -410,16 +443,28 @@ Deploys [Kubernetes API Server](https://kubernetes.io/docs/reference/command-lin
 | kubernetes.apiServer.affinity | object | `{}` | Affinity |
 | kubernetes.apiServer.annotations | object | `{}` | Annotations for Workload |
 | kubernetes.apiServer.args | object | `{}` | Extra arguments for the kube-apiserver |
+| kubernetes.apiServer.audit.backend | string | `"log"` | Configure Audit Backend (log, webhook, both) |
+| kubernetes.apiServer.audit.enabled | bool | `false` | Enable Audit Log |
+| kubernetes.apiServer.audit.log.maxAge | string | `"7"` | Defines the maximum number of days to retain old audit log files |
+| kubernetes.apiServer.audit.log.maxBackup | string | `"2"` | Defines the maximum number of audit log files to retain |
+| kubernetes.apiServer.audit.log.maxSize | string | `"100"` | Defines the maximum size in megabytes of the audit log file before it gets rotated |
+| kubernetes.apiServer.audit.log.truncateEnabled | bool | `false` | Whether event and batch truncating is enabled |
+| kubernetes.apiServer.audit.log.truncateMaxBatchSize | string | `"10485760"` | Maximum size in bytes of the batch sent to the underlying backend |
+| kubernetes.apiServer.audit.log.truncateMaxEventSize | string | `"102400"` | Maximum size in bytes of the audit event sent to the underlying backend |
+| kubernetes.apiServer.audit.policy | string | `"# Log all requests at the Metadata level.\napiVersion: audit.k8s.io/v1\nkind: Policy\nrules:\n  - level: Metadata\n"` | Audit Policy |
+| kubernetes.apiServer.audit.webhook.config | string | `"apiVersion: v1\nkind: Config\nclusters:\n- name: audit-webhook\n  cluster:\n    server: https://audit-webhook.audit-webhook.svc:9443/audit\n    insecure-skip-tls-verify: false\ncontexts:\n- name: audit-webhook\n  context:\n    cluster: audit-webhook\n    user: \"\"\ncurrent-context: audit-webhook\nusers: []\npreferences: {}\n"` | Kubeconfig for webhook |
+| kubernetes.apiServer.audit.webhook.initialBackoff | string | `"10s"` | Defines the time to wait before retrying the first failed request. |
 | kubernetes.apiServer.autoscaling.enabled | bool | `false` | Enable Horizontal Pod Autoscaler |
 | kubernetes.apiServer.autoscaling.maxReplicas | int | `5` | Maximum available Replicas |
 | kubernetes.apiServer.autoscaling.minReplicas | int | `1` | Minimum available Replicas |
 | kubernetes.apiServer.autoscaling.targetCPUUtilizationPercentage | int | `80` | Benchmark CPU Usage |
 | kubernetes.apiServer.autoscaling.targetMemoryUtilizationPercentage | string | `nil` | Benchmark Memory Usage |
-| kubernetes.apiServer.certSANs.dnsNames | list | `[]` | Additonal API-Server dns names for ETCD ceritifcate |
-| kubernetes.apiServer.certSANs.ipAddresses | list | `[]` | Additonal API-Server adresses for ETCD ceritifcate |
+| kubernetes.apiServer.certSANs.dnsNames | list | `[]` | Additional API-Server dns names for ETCD certificate |
+| kubernetes.apiServer.certSANs.ipAddresses | list | `[]` | Additional API-Server addresses for ETCD certificate |
 | kubernetes.apiServer.enabled | bool | `true` | Enable Kubernetes API-Server |
 | kubernetes.apiServer.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
 | kubernetes.apiServer.envsFrom | list | `[]` | Extra environment variables from |
+| kubernetes.apiServer.etcdEndpoints | string | `"pods"` | ETCD Endpoints on how the API-Server should communicate with the etcd cluster. Can be "pods" or "service" |
 | kubernetes.apiServer.image.digest | string | `""` | Image digest |
 | kubernetes.apiServer.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
 | kubernetes.apiServer.image.registry | string | `"registry.k8s.io"` | Image registry |
@@ -433,10 +478,10 @@ Deploys [Kubernetes API Server](https://kubernetes.io/docs/reference/command-lin
 | kubernetes.apiServer.labels | object | `{}` | Labels for Workload |
 | kubernetes.apiServer.metrics.probe.annotations | object | `{}` | Assign additional Annotations |
 | kubernetes.apiServer.metrics.probe.enabled | bool | `false` | Enable Probe |
-| kubernetes.apiServer.metrics.probe.interval | string | `""` | Probeing Interval |
+| kubernetes.apiServer.metrics.probe.interval | string | `""` | Probing Interval |
 | kubernetes.apiServer.metrics.probe.jobName | string | `""` | Name of the scrape_job |
 | kubernetes.apiServer.metrics.probe.labels | object | `{}` | Assign additional labels according to Prometheus' probeSelector matching labels |
-| kubernetes.apiServer.metrics.probe.module | string | `""` | Module to use for the probeing |
+| kubernetes.apiServer.metrics.probe.module | string | `""` | Module to use for the probing |
 | kubernetes.apiServer.metrics.probe.namespace | string | `""` | Install the Probe into a different Namespace, as the monitoring stack one (default: the release one) |
 | kubernetes.apiServer.metrics.probe.prober | object | `{"path":"","proxyUrl":"","scheme":"","url":""}` | Prober Configuration |
 | kubernetes.apiServer.metrics.probe.prober.path | string | `""` | Prober path |
@@ -583,9 +628,65 @@ Deploys [ETCD](https://etcd.io/).
 |-----|------|---------|-------------|
 | kubernetes.etcd.affinity | object | `{}` | Affinity |
 | kubernetes.etcd.annotations | object | `{}` | Annotations for Workload |
-| kubernetes.etcd.args | object | `{"snapshot-count":10000}` | Extra arguments for ETCD |
-| kubernetes.etcd.certSANs.dnsNames | list | `[]` | Additonal DNS names for ETCD ceritifcate |
-| kubernetes.etcd.certSANs.ipAddresses | list | `[]` | Additonal IP adresses names for ETCD ceritifcate |
+| kubernetes.etcd.args | object | `{}` | Extra arguments for ETCD |
+| kubernetes.etcd.certSANs.dnsNames | list | `[]` | Additional DNS names for ETCD certificate |
+| kubernetes.etcd.certSANs.ipAddresses | list | `[]` | Additional IP addresses names for ETCD certificate |
+| kubernetes.etcd.cleanup.affinity | object | `{}` | Affinity |
+| kubernetes.etcd.cleanup.annotations | object | `{}` | Annotations for Workload |
+| kubernetes.etcd.cleanup.enabled | bool | `false` | Enable ETCD Backup Cleanup |
+| kubernetes.etcd.cleanup.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
+| kubernetes.etcd.cleanup.envsFrom | list | `[]` | Extra environment variables from |
+| kubernetes.etcd.cleanup.failedJobsHistoryLimit | int | `3` | Failed Jobs History Limit for ETCD Backup Cleanup |
+| kubernetes.etcd.cleanup.image.digest | string | `""` | Image Digest |
+| kubernetes.etcd.cleanup.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| kubernetes.etcd.cleanup.image.registry | string | `"docker.io"` | Image registry |
+| kubernetes.etcd.cleanup.image.repository | string | `"busybox"` | Image repository |
+| kubernetes.etcd.cleanup.image.tag | string | `"1.37.0"` | Image tag |
+| kubernetes.etcd.cleanup.imagePullSecrets | list | `[]` | Image pull Secrets |
+| kubernetes.etcd.cleanup.injectProxy | bool | `false` | Inject Proxy as Environment Variables |
+| kubernetes.etcd.cleanup.labels | object | `{}` | Labels for Workload |
+| kubernetes.etcd.cleanup.nodeSelector | object | `{}` | Node Selector |
+| kubernetes.etcd.cleanup.podAnnotations | object | `{}` | Pod Annotations |
+| kubernetes.etcd.cleanup.podLabels | object | `{}` | Pod Labels |
+| kubernetes.etcd.cleanup.podSecurityContext | object | `{"enabled":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Pod Security Context |
+| kubernetes.etcd.cleanup.priorityClassName | string | `""` | Pod PriorityClassName |
+| kubernetes.etcd.cleanup.resources | object | `{}` | Pod Requests and limits |
+| kubernetes.etcd.cleanup.restartPolicy | string | `"OnFailure"` | Restart Policy for ETCD Backup Cleanup |
+| kubernetes.etcd.cleanup.retentionDays | string | `"7"` | Number of days to keep backups |
+| kubernetes.etcd.cleanup.schedule | string | `"0 8 * * *"` | Schedule for ETCD Backup Cleanup |
+| kubernetes.etcd.cleanup.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"readOnlyRootFilesystem":true}` | Container Security Context |
+| kubernetes.etcd.cleanup.successfulJobsHistoryLimit | int | `3` | Successful Jobs History Limit for ETCD Backup Cleanup |
+| kubernetes.etcd.cleanup.tolerations | list | `[]` | Tolerations |
+| kubernetes.etcd.cleanup.topologySpreadConstraints | list | `[]` | TopologySpreadConstraints for all workloads |
+| kubernetes.etcd.cleanup.ttlSecondsAfterFinished | int | `120` | ttlSecondsAfterFinished for ETCD Backup Cleanup |
+| kubernetes.etcd.defrag.affinity | object | `{}` | Affinity |
+| kubernetes.etcd.defrag.annotations | object | `{}` | Annotations for Workload |
+| kubernetes.etcd.defrag.defragRule | string | `"dbQuotaUsage > 0.8 || dbSize - dbSizeInUse > 200*1024*1024"` | defrag-rule for ETCD Defragmentation (https://github.com/ahrtr/etcd-defrag?tab=readme-ov-file#defragmentation-rule) |
+| kubernetes.etcd.defrag.enabled | bool | `false` | Enable ETCD Defragmentation |
+| kubernetes.etcd.defrag.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
+| kubernetes.etcd.defrag.envsFrom | list | `[]` | Extra environment variables from |
+| kubernetes.etcd.defrag.failedJobsHistoryLimit | int | `3` | Failed Jobs History Limit for ETCD Defragmentation |
+| kubernetes.etcd.defrag.image.digest | string | `""` | Image Digest |
+| kubernetes.etcd.defrag.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| kubernetes.etcd.defrag.image.registry | string | `"ghcr.io"` | Image registry |
+| kubernetes.etcd.defrag.image.repository | string | `"ahrtr/etcd-defrag"` | Image repository |
+| kubernetes.etcd.defrag.image.tag | string | `"v0.18.0"` | Image tag |
+| kubernetes.etcd.defrag.imagePullSecrets | list | `[]` | Image pull Secrets |
+| kubernetes.etcd.defrag.injectProxy | bool | `false` | Inject Proxy as Environment Variables |
+| kubernetes.etcd.defrag.labels | object | `{}` | Labels for Workload |
+| kubernetes.etcd.defrag.nodeSelector | object | `{}` | Node Selector |
+| kubernetes.etcd.defrag.podAnnotations | object | `{}` | Pod Annotations |
+| kubernetes.etcd.defrag.podLabels | object | `{}` | Pod Labels |
+| kubernetes.etcd.defrag.podSecurityContext | object | `{"enabled":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Pod Security Context |
+| kubernetes.etcd.defrag.priorityClassName | string | `""` | Pod PriorityClassName |
+| kubernetes.etcd.defrag.resources | object | `{}` | Pod Requests and limits |
+| kubernetes.etcd.defrag.restartPolicy | string | `"OnFailure"` | Restart Policy for ETCD Defragmentation |
+| kubernetes.etcd.defrag.schedule | string | `"0 0 1 * *"` | Schedule for ETCD Defragmentation |
+| kubernetes.etcd.defrag.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"readOnlyRootFilesystem":true}` | Container Security Context |
+| kubernetes.etcd.defrag.successfulJobsHistoryLimit | int | `3` | Successful Jobs History Limit for ETCD Defragmentation |
+| kubernetes.etcd.defrag.tolerations | list | `[]` | Tolerations |
+| kubernetes.etcd.defrag.topologySpreadConstraints | list | `[]` | TopologySpreadConstraints for all workloads |
+| kubernetes.etcd.defrag.ttlSecondsAfterFinished | int | `120` | ttlSecondsAfterFinished for ETCD Defragmentation |
 | kubernetes.etcd.enabled | bool | `true` | Enable ETCD |
 | kubernetes.etcd.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
 | kubernetes.etcd.envsFrom | list | `[]` | Extra environment variables from |
@@ -593,10 +694,15 @@ Deploys [ETCD](https://etcd.io/).
 | kubernetes.etcd.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
 | kubernetes.etcd.image.registry | string | `"registry.k8s.io"` | Image registry |
 | kubernetes.etcd.image.repository | string | `"etcd"` | Image repository |
-| kubernetes.etcd.image.tag | string | `"3.5.7-0"` | Image tag |
+| kubernetes.etcd.image.tag | string | `"3.6.4-0"` | Image tag |
 | kubernetes.etcd.imagePullSecrets | list | `[]` | Image pull Secrets |
 | kubernetes.etcd.injectProxy | bool | `false` | Inject Proxy as Environment Variables |
 | kubernetes.etcd.labels | object | `{}` | Labels for Workload |
+| kubernetes.etcd.livenessProbe.failureThreshold | int | `8` | Set failure threshold for livenessProbe |
+| kubernetes.etcd.livenessProbe.initialDelaySeconds | int | `15` | Set initial delay seconds for livenessProbe |
+| kubernetes.etcd.livenessProbe.path | string | `"/livez"` | Set path for livenessProbe |
+| kubernetes.etcd.livenessProbe.scheme | string | `"HTTP"` | Set scheme for livenessProbe |
+| kubernetes.etcd.livenessProbe.timeoutSeconds | int | `15` | Set timeout seconds for livenessProbe |
 | kubernetes.etcd.metrics.service.annotations | object | `{}` | Service Annotations |
 | kubernetes.etcd.metrics.service.labels | object | `{}` | Service Labels |
 | kubernetes.etcd.metrics.serviceMonitor.annotations | object | `{}` | Assign additional Annotations |
@@ -627,6 +733,11 @@ Deploys [ETCD](https://etcd.io/).
 | kubernetes.etcd.ports.metrics | int | `2381` | ETCD Metrics Port |
 | kubernetes.etcd.ports.peer | int | `2380` | ETCD Peer Port |
 | kubernetes.etcd.priorityClassName | string | `""` | Pod PriorityClassName |
+| kubernetes.etcd.readinessProbe.failureThreshold | int | `3` | Set failure threshold for readinessProbe |
+| kubernetes.etcd.readinessProbe.initialDelaySeconds | int | `15` | Set initial delay seconds for readinessProbe |
+| kubernetes.etcd.readinessProbe.path | string | `"/readyz"` | Set path for readinessProbe |
+| kubernetes.etcd.readinessProbe.scheme | string | `"HTTP"` | Set scheme for readinessProbe |
+| kubernetes.etcd.readinessProbe.timeoutSeconds | int | `5` | Set timeout seconds for readinessProbe |
 | kubernetes.etcd.replicaCount | int | `3` | Replicas for ETCD Pods |
 | kubernetes.etcd.resources | object | `{"requests":{"cpu":"100m","memory":"128Mi"}}` | Pod Requests and limits |
 | kubernetes.etcd.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"readOnlyRootFilesystem":true}` | Container Security Context |
@@ -650,6 +761,7 @@ Scheduled snapshots of ETCD via Cronjob.
 | kubernetes.etcd.backup.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
 | kubernetes.etcd.backup.envsFrom | list | `[]` | Extra environment variables from |
 | kubernetes.etcd.backup.failedJobsHistoryLimit | int | `3` | Failed Jobs History Limit for ETCD Backup |
+| kubernetes.etcd.backup.imagePullSecrets | list | `[]` | Image pull Secrets |
 | kubernetes.etcd.backup.injectProxy | bool | `false` | Inject Proxy as Environment Variables |
 | kubernetes.etcd.backup.labels | object | `{}` | Labels for Workload |
 | kubernetes.etcd.backup.nodeSelector | object | `{}` | Node Selector |
@@ -696,6 +808,8 @@ The Konnectivity-Server is deployed alongside with the API-Server. It must be re
 | kubernetes.konnectivity.server.affinity | object | `{}` | Affinity |
 | kubernetes.konnectivity.server.annotations | object | `{}` | Annotations for Workload |
 | kubernetes.konnectivity.server.args | object | `{}` | Konnectivity Server extra arguments |
+| kubernetes.konnectivity.server.controlplane.enabled | bool | `false` | Enable Konnectivity Server for controlplane traffic |
+| kubernetes.konnectivity.server.controlplane.mode | string | `"GRPC"` | This controls the protocol between the API Server and the Konnectivity server. Supported values are "GRPC" and "HTTPConnect". "GRPC" will deploy konnectivity-server as a sidecar for apiserver. "HTTPConnect" will deploy konnectivity-server as separate deployment. |
 | kubernetes.konnectivity.server.enabled | bool | `true` | Enable Konnectivity Server |
 | kubernetes.konnectivity.server.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
 | kubernetes.konnectivity.server.envsFrom | list | `[]` | Extra environment variables from |
@@ -718,7 +832,7 @@ The Konnectivity-Server is deployed alongside with the API-Server. It must be re
 | kubernetes.konnectivity.server.replicaCount | int | `2` | Konnectivity Server Replicas (only used in HTTPConnect mode) |
 | kubernetes.konnectivity.server.resources | object | `{"requests":{"cpu":"100m","memory":"128Mi"}}` | Konnectivity Server resources |
 | kubernetes.konnectivity.server.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"enabled":true,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsUser":65534}` | Container Security Context |
-| kubernetes.konnectivity.server.sidecar | bool | `true` | Enable Konnectivity Server as sidecfar for API Server |
+| kubernetes.konnectivity.server.sidecar | bool | `true` | Enable Konnectivity Server as sidecar for API Server |
 | kubernetes.konnectivity.server.strategy | object | `{"rollingUpdate":{"maxUnavailable":"50%"},"type":"RollingUpdate"}` | Deployment Update Strategy |
 | kubernetes.konnectivity.server.tolerations | list | `[]` | Tolerations |
 | kubernetes.konnectivity.server.topologySpreadConstraints | list | `[]` | TopologySpreadConstraints for all workloads |
@@ -771,6 +885,14 @@ Deploys an administration pod which has the admin kubeconfig mounted and allows
 |-----|------|---------|-------------|
 | kubernetes.admin.affinity | object | `{}` | Affinity |
 | kubernetes.admin.annotations | object | `{}` | Annotations for Workload |
+| kubernetes.admin.connectivity.image.digest | string | `""` | Image Digest |
+| kubernetes.admin.connectivity.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| kubernetes.admin.connectivity.image.pullSecrets | list | `[]` | Image pull Secrets |
+| kubernetes.admin.connectivity.image.registry | string | `"ghcr.io"` | Image registry |
+| kubernetes.admin.connectivity.image.repository | string | `"kvaps/kubernetes-tools"` | Image repository |
+| kubernetes.admin.connectivity.image.tag | string | `"v0.13.4"` | Image tag |
+| kubernetes.admin.connectivity.resources | object | `{}` | Resources configuration |
+| kubernetes.admin.connectivity.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"privileged":false,"runAsGroup":20000,"runAsUser":20000}` | Container Security Context |
 | kubernetes.admin.enabled | bool | `true` | Enable Kubernetes Administration |
 | kubernetes.admin.envs | object | `{}` | Extra environment variables (`key: value` style, allows templating) |
 | kubernetes.admin.envsFrom | list | `[]` | Extra environment variables from |
@@ -779,7 +901,6 @@ Deploys an administration pod which has the admin kubeconfig mounted and allows
 | kubernetes.admin.image.registry | string | `"ghcr.io"` | Image registry |
 | kubernetes.admin.image.repository | string | `"kvaps/kubernetes-tools"` | Image repository |
 | kubernetes.admin.image.tag | string | `"v0.13.4"` | Image tag (Version Overwrites) Overrides the image tag whose default is the chart appVersion. |
-| kubernetes.admin.image.use_jobs | bool | `true` | Use the Job Image (used for kubectl admin and kubeadmin bootstrap) |
 | kubernetes.admin.imagePullSecrets | list | `[]` | Image pull Secrets |
 | kubernetes.admin.injectProxy | bool | `true` | Inject Proxy as Environment Variables |
 | kubernetes.admin.labels | object | `{}` | Labels for Workload |
@@ -837,7 +958,7 @@ Available Values for the [Autsocaler component](#autoscaler).
 ---
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| autoscaler.enabled | bool | `true` | Enable autsocaler component |
+| autoscaler.enabled | bool | `false` | Enable autoscaler component |
 | autoscaler.expanderPriorities | object | `{}` | The expanderPriorities is used if `extraArgs.expander` contains `priority` and expanderPriorities is also set with the priorities. If `args.expander` contains `priority`, then expanderPriorities is used to define cluster-autoscaler-priority-expander priorities. See: https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/expander/priority/readme.md |
 | autoscaler.priorityConfigMapAnnotations | object | `{}` | Annotations to add to `cluster-autoscaler-priority-expander` ConfigMap. |
 
@@ -849,7 +970,15 @@ Available Values for the [Autsocaler component](#autoscaler).
 | autoscaler.affinity | object | `{}` | Affinity |
 | autoscaler.annotations | object | `{}` | Annotations for Workload |
 | autoscaler.args | object | `{"leader-elect":true,"logtostderr":true,"scale-down-enabled":true,"stderrthreshold":"info","v":4}` | Additional container arguments. Refer to https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca for the full list of cluster autoscaler parameters and their default values. Everything after the first _ will be ignored allowing the use of multi-string arguments. |
-| autoscaler.enabled | bool | `true` | Enable autsocaler component |
+| autoscaler.connectivity.image.digest | string | `""` | Image Digest |
+| autoscaler.connectivity.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| autoscaler.connectivity.image.pullSecrets | list | `[]` | Image pull Secrets |
+| autoscaler.connectivity.image.registry | string | `"ghcr.io"` | Image registry |
+| autoscaler.connectivity.image.repository | string | `"kvaps/kubernetes-tools"` | Image repository |
+| autoscaler.connectivity.image.tag | string | `"v0.13.4"` | Image tag |
+| autoscaler.connectivity.resources | object | `{}` | Resources configuration |
+| autoscaler.connectivity.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"enabled":true,"privileged":false,"runAsGroup":20000,"runAsUser":20000}` | Container Security Context |
+| autoscaler.enabled | bool | `false` | Enable autoscaler component |
 | autoscaler.envs | object | `{"CAPI_GROUP":"cluster.k8s.io"}` | Extra environment variables (`key: value` style, allows templating) |
 | autoscaler.envsFrom | list | `[]` | Extra environment variables from |
 | autoscaler.expanderPriorities | object | `{}` | The expanderPriorities is used if `extraArgs.expander` contains `priority` and expanderPriorities is also set with the priorities. If `args.expander` contains `priority`, then expanderPriorities is used to define cluster-autoscaler-priority-expander priorities. See: https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/expander/priority/readme.md |
diff --git a/charts/vcluster/addons/scripts/configure-current.sh b/charts/vcluster/addons/scripts/configure-current.sh
index 745c42d..3c16518 100644
--- a/charts/vcluster/addons/scripts/configure-current.sh
+++ b/charts/vcluster/addons/scripts/configure-current.sh
@@ -11,7 +11,7 @@ CA=$(base64 /pki/admin-client/ca.crt | tr -d '\n')
 C_CERT=$(base64 /pki/admin-client/tls.crt | tr -d '\n')
 C_KEY=$(base64 /pki/admin-client/tls.key | tr -d '\n')
 
-{{- $kubeconfigs := $.Values.lifecycle.kubeconfigs }}
+{{- $kubeconfigs := $lifecycle.kubeconfigs }}
 # Iterate over all kubeconfigs
 {{- range $kubeconfigs }}{{"\n"}}
   {{- $name := (include "pkg.utils.template" (dict "tpl" (required "kubeconfig.name is required" .name) "ctx" $)) -}}
diff --git a/charts/vcluster/addons/scripts/configure-vcluster.sh b/charts/vcluster/addons/scripts/configure-vcluster.sh
index 208e964..7b4054d 100644
--- a/charts/vcluster/addons/scripts/configure-vcluster.sh
+++ b/charts/vcluster/addons/scripts/configure-vcluster.sh
@@ -100,13 +100,19 @@ kubectl -n kube-system delete configmap/kube-proxy daemonset/kube-proxy 2>/dev/n
 {{- if $job.cilium.enabled }}
 if kubectl get ds cilium -n kube-system &> /dev/null; then
 	echo "Cilium already installed"
-else 
+else
   {{- if or (and ($job.cilium.on_install) ($.Release.IsInstall)) (not $job.cilium.on_install) }}
 # install cilium
 helm repo add cilium https://helm.cilium.io/
 helm upgrade --install cilium cilium/cilium {{ with $job.cilium.version }}--version {{ . }} {{ end }} \
     {{- if not ($kubernetes.kubeProxy.enabled) }}
-    --set kubeProxyReplacement=strict \
+    --set kubeProxyReplacement=true \
+    {{- if $job.cilium.bgpControlPlane.enabled }}
+    --set bgpControlPlane.enabled=true \
+    {{- end }}
+    {{- if $job.cilium.devices }}
+    --set devices={{ $job.cilium.devices | quote }} \
+    {{- end }}
       {{- if (include "kubernetes.api.endpointIP" $) }}
     --set k8sServiceHost={{ include "kubernetes.api.endpointIP" $ }} \
     --set k8sServicePort={{ include "kubernetes.api.endpointPort" $ }} \
@@ -140,12 +146,12 @@ fi
 # ------------------------------------------------------------------------------
 # Additional Manifests
 # ------------------------------------------------------------------------------
-{{- if $.Release.IsInstall }}
-  {{- with $lifecycle.vcluster.extraManifestsOnInstall }}
-kubectl apply{{- range $key, $value := . }} -f /manifests/{{ $key }} {{- end }}
-  {{- end }}
+{{- range $lifecycle.vcluster.extraOnlineManifests }}
+kubectl apply --server-side -f {{ . | quote }} 2>/dev/null || true
 {{- end }}
 
-{{- with $lifecycle.vcluster.extraManifests }}
-kubectl apply{{- range $key, $value := . }} -f /manifests/{{ $key }} {{- end }}
+{{- if $.Release.IsInstall }}
+  {{- range $lifecycle.vcluster.extraOnlineManifestsOnInstall }}
+kubectl apply --server-side -f {{ . | quote }} 2>/dev/null || true
+  {{- end }}
 {{- end }}
diff --git a/charts/vcluster/ci/registry-primary-only.yaml b/charts/vcluster/ci/registry-primary-only.yaml
new file mode 100644
index 0000000..cf67100
--- /dev/null
+++ b/charts/vcluster/ci/registry-primary-only.yaml
@@ -0,0 +1,12 @@
+global:
+  # Image Registries
+  registries:
+    # -- Default Registry (used for kubeadm, regcred secret etc.)
+    primary:
+      # -- Registry Endpoint
+      endpoint: "docker.io"
+      creds:
+        # -- Registry Username
+        username: "foo"
+        # -- Registry Password
+        password: "bar"
diff --git a/charts/vcluster/ci/registry-secondary.yaml b/charts/vcluster/ci/registry-secondary.yaml
new file mode 100644
index 0000000..71b7145
--- /dev/null
+++ b/charts/vcluster/ci/registry-secondary.yaml
@@ -0,0 +1,19 @@
+global:
+  # Image Registries
+  registries:
+    # -- Default Registry (used for kubeadm, regcred secret etc.)
+    primary:
+      # -- Registry Endpoint
+      endpoint: "docker.io"
+      creds:
+        # -- Registry Username
+        username: "foo"
+        # -- Registry Password
+        password: "bar"
+    # -- Additional Registries (used in regcred secret)
+    secondaries:
+      # -- Key: registry url
+      ghcr.io:
+        creds:
+          username: "foo"
+          password: "baz"
diff --git a/charts/vcluster/manifests/kubernetes/coredns.yaml b/charts/vcluster/manifests/kubernetes/coredns.yaml
index 7c903a2..af05fda 100644
--- a/charts/vcluster/manifests/kubernetes/coredns.yaml
+++ b/charts/vcluster/manifests/kubernetes/coredns.yaml
@@ -99,7 +99,7 @@ metadata:
     addonmanager.kubernetes.io/mode: Reconcile
     kubernetes.io/name: "CoreDNS"
   {{- if $kubernetes.coredns.labels }}
-    {{- toYaml $kubernetes.coredns.labels | nindent 4  }}
+    {{- toYaml $kubernetes.coredns.labels | nindent 4 }}
   {{- end }}
   {{- with $kubernetes.coredns.annotations }}
   annotations:
@@ -135,22 +135,15 @@ spec:
       {{- end }}
       priorityClassName: {{ $kubernetes.coredns.priorityClassName }}
       serviceAccountName: coredns
+      {{- with $kubernetes.coredns.affinity }}
       affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                  - key: k8s-app
-                    operator: In
-                    values: ["kube-dns"]
-              topologyKey: kubernetes.io/hostname
-      {{- with $kubernetes.coredns.tolerations }}        
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $kubernetes.coredns.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with $kubernetes.coredns.nodeSelector }}        
+      {{- with $kubernetes.coredns.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
diff --git a/charts/vcluster/manifests/operating-system-manager/operatingsystemconfigs-crd.yaml b/charts/vcluster/manifests/operating-system-manager/operatingsystemconfigs-crd.yaml
index b1ba823..83f7004 100644
--- a/charts/vcluster/manifests/operating-system-manager/operatingsystemconfigs-crd.yaml
+++ b/charts/vcluster/manifests/operating-system-manager/operatingsystemconfigs-crd.yaml
@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: operatingsystemconfigs.operatingsystemmanager.k8c.io
 spec:
   group: operatingsystemmanager.k8c.io
@@ -23,14 +22,19 @@ spec:
         description: OperatingSystemConfig is the object that represents the OperatingSystemConfig
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -47,9 +51,9 @@ spec:
                     description: Files is a list of files that should exist in the
                       instance
                     items:
-                      description: File is a file that should get written to the host's
-                        file system. The content can either be inlined or referenced
-                        from a secret in the same namespace.
+                      description: |-
+                        File is a file that should get written to the host's file system. The content can either be inlined or
+                        referenced from a secret in the same namespace.
                       properties:
                         content:
                           description: Content describe the file's content.
@@ -75,9 +79,9 @@ spec:
                           type: string
                         permissions:
                           default: 644
-                          description: Permissions describes with which permissions
-                            the file should get written to the file system. Should
-                            be in decimal base and without any leading zeroes.
+                          description: |-
+                            Permissions describes with which permissions the file should get written to the file system.
+                            Should be in decimal base and without any leading zeroes.
                           format: int32
                           type: integer
                       required:
@@ -132,7 +136,7 @@ spec:
                           description: Content is the unit's content.
                           type: string
                         dropIns:
-                          description: DropIns is a list of drop-ins for this unit.
+                          description: DropIns is a list of drop_ins for this unit.
                           items:
                             description: DropIn is a drop-in configuration for a systemd
                               unit.
@@ -179,6 +183,7 @@ spec:
                     - aws
                     - azure
                     - digitalocean
+                    - edge
                     - gce
                     - hetzner
                     - kubevirt
@@ -209,7 +214,6 @@ spec:
                 enum:
                 - flatcar
                 - rhel
-                - centos
                 - ubuntu
                 - amzn2
                 - rockylinux
@@ -225,9 +229,9 @@ spec:
                     description: Files is a list of files that should exist in the
                       instance
                     items:
-                      description: File is a file that should get written to the host's
-                        file system. The content can either be inlined or referenced
-                        from a secret in the same namespace.
+                      description: |-
+                        File is a file that should get written to the host's file system. The content can either be inlined or
+                        referenced from a secret in the same namespace.
                       properties:
                         content:
                           description: Content describe the file's content.
@@ -253,9 +257,9 @@ spec:
                           type: string
                         permissions:
                           default: 644
-                          description: Permissions describes with which permissions
-                            the file should get written to the file system. Should
-                            be in decimal base and without any leading zeroes.
+                          description: |-
+                            Permissions describes with which permissions the file should get written to the file system.
+                            Should be in decimal base and without any leading zeroes.
                           format: int32
                           type: integer
                       required:
@@ -310,7 +314,7 @@ spec:
                           description: Content is the unit's content.
                           type: string
                         dropIns:
-                          description: DropIns is a list of drop-ins for this unit.
+                          description: DropIns is a list of drop_ins for this unit.
                           items:
                             description: DropIn is a drop-in configuration for a systemd
                               unit.
@@ -366,4 +370,4 @@ spec:
         - spec
         type: object
     served: true
-    storage: true
\ No newline at end of file
+    storage: true
diff --git a/charts/vcluster/manifests/operating-system-manager/operatingsystemprofiles-crd.yaml b/charts/vcluster/manifests/operating-system-manager/operatingsystemprofiles-crd.yaml
index f9b48bf..d5f1f69 100644
--- a/charts/vcluster/manifests/operating-system-manager/operatingsystemprofiles-crd.yaml
+++ b/charts/vcluster/manifests/operating-system-manager/operatingsystemprofiles-crd.yaml
@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.2
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: operatingsystemprofiles.operatingsystemmanager.k8c.io
 spec:
   group: operatingsystemmanager.k8c.io
@@ -23,14 +22,19 @@ spec:
         description: OperatingSystemProfile is the object that represents the OperatingSystemProfile
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -47,9 +51,9 @@ spec:
                     description: Files is a list of files that should exist in the
                       instance
                     items:
-                      description: File is a file that should get written to the host's
-                        file system. The content can either be inlined or referenced
-                        from a secret in the same namespace.
+                      description: |-
+                        File is a file that should get written to the host's file system. The content can either be inlined or
+                        referenced from a secret in the same namespace.
                       properties:
                         content:
                           description: Content describe the file's content.
@@ -75,9 +79,9 @@ spec:
                           type: string
                         permissions:
                           default: 644
-                          description: Permissions describes with which permissions
-                            the file should get written to the file system. Should
-                            be in decimal base and without any leading zeroes.
+                          description: |-
+                            Permissions describes with which permissions the file should get written to the file system.
+                            Should be in decimal base and without any leading zeroes.
                           format: int32
                           type: integer
                       required:
@@ -122,8 +126,9 @@ spec:
                         type: object
                     type: object
                   supportedContainerRuntimes:
-                    description: SupportedContainerRuntimes represents the container
-                      runtimes supported by the given OS
+                    description: |-
+                      SupportedContainerRuntimes represents the container runtimes supported by the given OS.
+                      Docker has been deprecated and is no-op.
                     items:
                       description: ContainerRuntimeSpec aggregates information about
                         a specific container runtime
@@ -132,9 +137,9 @@ spec:
                           description: Files to add to the main files list when the
                             containerRuntime is selected
                           items:
-                            description: File is a file that should get written to
-                              the host's file system. The content can either be inlined
-                              or referenced from a secret in the same namespace.
+                            description: |-
+                              File is a file that should get written to the host's file system. The content can either be inlined or
+                              referenced from a secret in the same namespace.
                             properties:
                               content:
                                 description: Content describe the file's content.
@@ -160,10 +165,9 @@ spec:
                                 type: string
                               permissions:
                                 default: 644
-                                description: Permissions describes with which permissions
-                                  the file should get written to the file system.
-                                  Should be in decimal base and without any leading
-                                  zeroes.
+                                description: |-
+                                  Permissions describes with which permissions the file should get written to the file system.
+                                  Should be in decimal base and without any leading zeroes.
                                 format: int32
                                 type: integer
                             required:
@@ -204,7 +208,7 @@ spec:
                           description: Content is the unit's content.
                           type: string
                         dropIns:
-                          description: DropIns is a list of drop-ins for this unit.
+                          description: DropIns is a list of drop_ins for this unit.
                           items:
                             description: DropIn is a drop-in configuration for a systemd
                               unit.
@@ -241,7 +245,6 @@ spec:
                 enum:
                 - flatcar
                 - rhel
-                - centos
                 - ubuntu
                 - amzn2
                 - rockylinux
@@ -257,9 +260,9 @@ spec:
                     description: Files is a list of files that should exist in the
                       instance
                     items:
-                      description: File is a file that should get written to the host's
-                        file system. The content can either be inlined or referenced
-                        from a secret in the same namespace.
+                      description: |-
+                        File is a file that should get written to the host's file system. The content can either be inlined or
+                        referenced from a secret in the same namespace.
                       properties:
                         content:
                           description: Content describe the file's content.
@@ -285,9 +288,9 @@ spec:
                           type: string
                         permissions:
                           default: 644
-                          description: Permissions describes with which permissions
-                            the file should get written to the file system. Should
-                            be in decimal base and without any leading zeroes.
+                          description: |-
+                            Permissions describes with which permissions the file should get written to the file system.
+                            Should be in decimal base and without any leading zeroes.
                           format: int32
                           type: integer
                       required:
@@ -332,8 +335,9 @@ spec:
                         type: object
                     type: object
                   supportedContainerRuntimes:
-                    description: SupportedContainerRuntimes represents the container
-                      runtimes supported by the given OS
+                    description: |-
+                      SupportedContainerRuntimes represents the container runtimes supported by the given OS.
+                      Docker has been deprecated and is no-op.
                     items:
                       description: ContainerRuntimeSpec aggregates information about
                         a specific container runtime
@@ -342,9 +346,9 @@ spec:
                           description: Files to add to the main files list when the
                             containerRuntime is selected
                           items:
-                            description: File is a file that should get written to
-                              the host's file system. The content can either be inlined
-                              or referenced from a secret in the same namespace.
+                            description: |-
+                              File is a file that should get written to the host's file system. The content can either be inlined or
+                              referenced from a secret in the same namespace.
                             properties:
                               content:
                                 description: Content describe the file's content.
@@ -370,10 +374,9 @@ spec:
                                 type: string
                               permissions:
                                 default: 644
-                                description: Permissions describes with which permissions
-                                  the file should get written to the file system.
-                                  Should be in decimal base and without any leading
-                                  zeroes.
+                                description: |-
+                                  Permissions describes with which permissions the file should get written to the file system.
+                                  Should be in decimal base and without any leading zeroes.
                                 format: int32
                                 type: integer
                             required:
@@ -414,7 +417,7 @@ spec:
                           description: Content is the unit's content.
                           type: string
                         dropIns:
-                          description: DropIns is a list of drop-ins for this unit.
+                          description: DropIns is a list of drop_ins for this unit.
                           items:
                             description: DropIn is a drop-in configuration for a systemd
                               unit.
@@ -468,6 +471,7 @@ spec:
                       - aws
                       - azure
                       - digitalocean
+                      - edge
                       - gce
                       - hetzner
                       - kubevirt
@@ -510,4 +514,4 @@ spec:
         - spec
         type: object
     served: true
-    storage: true
\ No newline at end of file
+    storage: true
diff --git a/charts/vcluster/templates/components/autoscaler/deployment.yaml b/charts/vcluster/templates/components/autoscaler/deployment.yaml
index 82d3d38..52280d3 100644
--- a/charts/vcluster/templates/components/autoscaler/deployment.yaml
+++ b/charts/vcluster/templates/components/autoscaler/deployment.yaml
@@ -10,11 +10,11 @@ metadata:
   labels:
     {{- include "autoscaler.labels" . | nindent 4 }}
     {{- with (include "pkg.components.labels" (dict "labels" $manifest.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
   annotations:
     {{- with (include "pkg.components.annotations" (dict "annotations" $manifest.annotations "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   {{- if not $manifest.autoscaling.enabled }}
@@ -28,9 +28,9 @@ spec:
       {{- include "autoscaler.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      annotations: 
+      annotations:
         {{- include "pkg.components.pod_annotations" (dict "annotations" $manifest.podAnnotations "ctx" $) | nindent 8 }}
-      labels: 
+      labels:
         {{- include "pkg.components.pod_labels" (dict "labels" $manifest.podLabels "ctx" $) | nindent 8 }}
         {{- include "autoscaler.selectorLabels" . | nindent 8 }}
     spec:
@@ -44,7 +44,7 @@ spec:
         {{- with $manifest.imagePullSecrets }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
-      initContainers: {{- include "pkg.cluster.connectivity" $ | nindent 8 }}
+      initContainers: {{- include "pkg.cluster.connectivity" (dict "connectivity" $manifest.connectivity "ctx" $) | nindent 8 }}
       containers:
         - name: manager
           {{- with (include "pkg.components.securityContext" (dict "sc" $manifest.securityContext "ctx" $)) }}
@@ -89,7 +89,7 @@ spec:
           {{- with $manifest.volumeMounts }}
             {{- toYaml . | nindent 10 }}
           {{- end }}
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $manifest.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $manifest.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.affinity" (dict "affinity" $manifest.affinity "ctx" $)) }}
diff --git a/charts/vcluster/templates/components/autoscaler/hpa.yaml b/charts/vcluster/templates/components/autoscaler/hpa.yaml
index 4c8183e..0f648af 100644
--- a/charts/vcluster/templates/components/autoscaler/hpa.yaml
+++ b/charts/vcluster/templates/components/autoscaler/hpa.yaml
@@ -2,7 +2,7 @@
   {{- $manifest := $.Values.autoscaler.autoscaling -}}
   {{- if $manifest.enabled }}
 ---
-apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "autoscaler.fullname" $ }}
diff --git a/charts/vcluster/templates/components/autoscaler/pdb.yaml b/charts/vcluster/templates/components/autoscaler/pdb.yaml
index 15afcc8..5b923b7 100644
--- a/charts/vcluster/templates/components/autoscaler/pdb.yaml
+++ b/charts/vcluster/templates/components/autoscaler/pdb.yaml
@@ -2,7 +2,7 @@
   {{- $manifest := $.Values.autoscaler -}}
   {{- if $manifest.podDisruptionBudget -}}
 ---
-apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }}
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: {{ template "autoscaler.fullname" . }}
diff --git a/charts/vcluster/templates/components/autoscaler/serviceaccount.yaml b/charts/vcluster/templates/components/autoscaler/serviceaccount.yaml
index 7fc2e43..91df8ac 100644
--- a/charts/vcluster/templates/components/autoscaler/serviceaccount.yaml
+++ b/charts/vcluster/templates/components/autoscaler/serviceaccount.yaml
@@ -5,7 +5,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "autoscaler.serviceAccountName"  . }}
+  name: {{ include "autoscaler.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "autoscaler.labels" . | nindent 4 }}
diff --git a/charts/vcluster/templates/components/autoscaler/servicemonitor.yaml b/charts/vcluster/templates/components/autoscaler/servicemonitor.yaml
index 756c1e1..2ab4164 100644
--- a/charts/vcluster/templates/components/autoscaler/servicemonitor.yaml
+++ b/charts/vcluster/templates/components/autoscaler/servicemonitor.yaml
@@ -11,11 +11,11 @@ metadata:
   labels:
     {{- include "autoscaler.labels" . | nindent 4 }}
     {{- with $manifest.serviceMonitor.labels }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
   {{- with $manifest.serviceMonitor.annotations }}
   annotations:
-    {{-  . | nindent 4 }}
+    {{- . | nindent 4 }}
   {{- end }}
 spec:
   endpoints:
diff --git a/charts/vcluster/templates/components/kubernetes/_templates.tpl b/charts/vcluster/templates/components/kubernetes/_templates.tpl
index b971548..7ea4c42 100644
--- a/charts/vcluster/templates/components/kubernetes/_templates.tpl
+++ b/charts/vcluster/templates/components/kubernetes/_templates.tpl
@@ -82,6 +82,23 @@ Create a default certificate name.
 Generate etcd servers list.
 */}}
 {{- define "kubernetes.etcdEndpoints" -}}
+  {{- $kubernetes := $.Values.kubernetes -}}
+  {{- $fullName := include "kubernetes.fullname" . -}}
+  {{- if eq $kubernetes.apiServer.etcdEndpoints "service" -}}
+    {{- printf "https://%s-etcd.%s:%d" $fullName $.Release.Namespace (int $kubernetes.etcd.ports.client) -}}
+  {{- else -}}
+    {{- range $etcdcount, $e := until (int $kubernetes.etcd.replicaCount) -}}
+      {{- printf "https://" -}}
+      {{- printf "%s-etcd-%d." $fullName $etcdcount -}}
+      {{- printf "%s-etcd.%s:%d" $fullName $.Release.Namespace (int $kubernetes.etcd.ports.client) -}}
+      {{- if lt $etcdcount (sub (int $kubernetes.etcd.replicaCount) 1 ) -}}
+        {{- printf "," -}}
+      {{- end -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "kubernetes.etcdCtlEndpoints" -}}
   {{- $kubernetes := $.Values.kubernetes -}}
   {{- $fullName := include "kubernetes.fullname" . -}}
   {{- range $etcdcount, $e := until (int $kubernetes.etcd.replicaCount) -}}
@@ -144,6 +161,7 @@ Template for konnectivityServer containers
   {{- else }}
   - --mode=grpc
   - --uds-name=/run/konnectivity-server/konnectivity-server.socket
+  - --delete-existing-uds-file=true
   - --server-port=0
   {{- end }}
   - --agent-port={{ $kubernetes.konnectivity.server.ports.agent }}
diff --git a/charts/vcluster/templates/components/kubernetes/admin/deployment.yaml b/charts/vcluster/templates/components/kubernetes/admin/deployment.yaml
index 2513c10..2e1ca18 100644
--- a/charts/vcluster/templates/components/kubernetes/admin/deployment.yaml
+++ b/charts/vcluster/templates/components/kubernetes/admin/deployment.yaml
@@ -12,11 +12,11 @@ metadata:
   labels: {{- include "kubernetes.labels" $ | nindent 4 }}
     {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.admin.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
     {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.admin.annotations "ctx" $)) }}
   annotations:
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   replicas: {{ $kubernetes.admin.replicaCount }}
@@ -32,9 +32,12 @@ spec:
         {{- include "pkg.components.pod_labels" (dict "labels" $kubernetes.admin.podLabels "ctx" $) | nindent 8 }}
         {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
       annotations:
+        checksum/kubeconfig: {{ include (print $.Template.BasePath "/components/kubernetes/kubeconfig.yaml" ) . | sha256sum }}
+        checksum/kubeadm-config: {{ include (print $.Template.BasePath "/components/kubernetes/kubeadm-config.yaml" ) . | sha256sum }}
+        checksum/konnectivity-config: {{ include (print $.Template.BasePath "/components/kubernetes/konnectivity/manifests.yaml" ) . | sha256sum }}
         {{- include "pkg.components.pod_annotations" (dict "annotations" $kubernetes.admin.podAnnotations "ctx" $) | nindent 8 }}
     spec:
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $kubernetes.admin.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $kubernetes.admin.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.tolerations" (dict "tolerations" $kubernetes.admin.tolerations "ctx" $)) }}
@@ -73,14 +76,10 @@ spec:
         {{- end }}
       automountServiceAccountToken: false
       terminationGracePeriodSeconds: 5
-      initContainers: {{- include "pkg.cluster.connectivity" $ | nindent 8 }}
+      initContainers: {{- include "pkg.cluster.connectivity" (dict "connectivity" $kubernetes.admin.connectivity "ctx" $) | nindent 8 }}
       containers:
       - command: [ 'sleep', 'infinity' ]
-        {{- if $kubernetes.admin.image.use_jobs }}
-        image: {{ include "pkg.images.registry.convert" (dict "image" $jobs.jobs.image "ctx" $) }}
-        {{- else }}
         image: {{ include "pkg.images.registry.convert" (dict "image" $kubernetes.admin.image "ctx" $) }}
-        {{- end }}
         imagePullPolicy:  {{ include "pkg.images.registry.pullpolicy" (dict "policy" $kubernetes.admin.image.pullPolicy "ctx" $) }}
         {{- with (include "pkg.components.securityContext" (dict "sc" $kubernetes.admin.securityContext "ctx" $)) }}
         securityContext: {{ . | nindent 10 }}
diff --git a/charts/vcluster/templates/components/kubernetes/apiserver/config.yaml b/charts/vcluster/templates/components/kubernetes/apiserver/config.yaml
index 3282853..98eaa56 100644
--- a/charts/vcluster/templates/components/kubernetes/apiserver/config.yaml
+++ b/charts/vcluster/templates/components/kubernetes/apiserver/config.yaml
@@ -16,7 +16,7 @@ data:
     egressSelections:
     - name: cluster
       connection:
-        {{- if and $kubernetes.konnectivity.enabled  $kubernetes.konnectivity.server.enabled }}
+        {{- if and $kubernetes.konnectivity.enabled $kubernetes.konnectivity.server.enabled }}
           {{- if has $kubernetes.konnectivity.server.mode (list "HTTPConnect" "GRPC") }}
         proxyProtocol: {{ $kubernetes.konnectivity.server.mode }}
           {{- else }}
@@ -37,9 +37,29 @@ data:
         {{- else }}
         proxyProtocol: Direct
         {{- end }}
-    - name: master
+    - name: controlplane
       connection:
+        {{- if and $kubernetes.konnectivity.enabled $kubernetes.konnectivity.server.enabled $kubernetes.konnectivity.server.controlplane.enabled }}
+          {{- if has $kubernetes.konnectivity.server.controlplane.mode (list "HTTPConnect" "GRPC") }}
+        proxyProtocol: {{ $kubernetes.konnectivity.server.controlplane.mode }}
+          {{- else }}
+            {{- fail "$kubernetes.konnectivity.server.controlplane.mode supports only \"HTTPConnect\" and \"GRPC\" values" }}
+          {{- end }}
+        transport:
+          {{- if eq $kubernetes.konnectivity.server.controlplane.mode "GRPC" }}
+          uds:
+            udsName: /run/konnectivity-server/konnectivity-server.socket
+          {{- else }}
+          tcp:
+            url: "https://{{ $fullName }}-konnectivity-server:8131"
+            TLSConfig:
+              caBundle: /pki/konnectivity-client/ca.crt
+              clientKey: /pki/konnectivity-client/tls.key
+              clientCert: /pki/konnectivity-client/tls.crt
+          {{- end }}
+        {{- else }}
         proxyProtocol: Direct
+        {{- end }}
     - name: etcd
       connection:
         proxyProtocol: Direct
diff --git a/charts/vcluster/templates/components/kubernetes/apiserver/deployment.yaml b/charts/vcluster/templates/components/kubernetes/apiserver/deployment.yaml
index 612c0af..18d992c 100644
--- a/charts/vcluster/templates/components/kubernetes/apiserver/deployment.yaml
+++ b/charts/vcluster/templates/components/kubernetes/apiserver/deployment.yaml
@@ -12,11 +12,11 @@ metadata:
   labels: {{- include "kubernetes.labels" $ | nindent 4 }}
     {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.apiServer.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
     {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.apiServer.annotations "ctx" $)) }}
   annotations:
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   {{- if not $kubernetes.apiServer.autoscaling.enabled }}
@@ -30,14 +30,16 @@ spec:
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
   template:
     metadata:
-      labels: {{- include "kubernetes.labels" $ | nindent 8 }}
+      labels: {{- include "kubernetes.selectorLabels" $ | nindent 8 }}
         {{- include "pkg.components.pod_labels" (dict "labels" $kubernetes.apiServer.podLabels "ctx" $) | nindent 8 }}
         {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
       annotations:
         checksum/config: {{ include (print $.Template.BasePath "/components/kubernetes/apiserver/config.yaml" ) . | sha256sum }}
+        checksum/policy: {{ include (print $.Template.BasePath "/components/kubernetes/apiserver/policy.yaml" ) . | sha256sum }}
+        checksum/konnectivity-config: {{ include (print $.Template.BasePath "/components/kubernetes/konnectivity/configmap.yaml" ) . | sha256sum }}
         {{- include "pkg.components.pod_annotations" (dict "annotations" $kubernetes.apiServer.podAnnotations "ctx" $) | nindent 8 }}
     spec:
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $kubernetes.apiServer.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $kubernetes.apiServer.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.tolerations" (dict "tolerations" $kubernetes.apiServer.tolerations "ctx" $)) }}
@@ -111,6 +113,24 @@ spec:
         - --advertise-address={{ . }}
           {{- end }}
         {{- end }}
+        {{- if $kubernetes.apiServer.audit.enabled }}
+        - --audit-policy-file=/etc/kubernetes/audit/policy/policy.yaml
+        {{- if or (eq $kubernetes.apiServer.audit.backend "log") (eq $kubernetes.apiServer.audit.backend "both")}}
+        - --audit-log-path=/var/log/kubernetes/audit/{{ include "pkg.cluster.name" $ }}-audit.log
+        - --audit-log-maxage={{ $kubernetes.apiServer.audit.log.maxAge | int }}
+        - --audit-log-maxbackup={{ $kubernetes.apiServer.audit.log.maxBackup | int }}
+        - --audit-log-maxsize={{ $kubernetes.apiServer.audit.log.maxSize | int }}
+        {{- if $kubernetes.apiServer.audit.log.truncateEnabled }}
+        - --audit-log-truncate-enabled={{ $kubernetes.apiServer.audit.log.truncateEnabled }}
+        - --audit-log-truncate-max-batch-size={{ $kubernetes.apiServer.audit.log.truncateMaxBatchSize | int }}
+        - --audit-log-truncate-max-event-size={{ $kubernetes.apiServer.audit.log.truncateMaxEventSize | int }}
+        {{- end }}
+        {{- end }}
+        {{- if or (eq $kubernetes.apiServer.audit.backend "webhook") (eq $kubernetes.apiServer.audit.backend "both")}}
+        - --audit-webhook-config-file=/etc/kubernetes/audit/webhook/webhook.yaml
+        - --audit-webhook-initial-backoff={{ $kubernetes.apiServer.audit.webhook.initialBackoff }}
+        {{- end }}
+        {{- end }}
         {{- with $kubernetes.apiServer.args }}
           {{- include "pkg.utils.args" (dict "args" . "ctx" $) | nindent 8 }}
         {{- end }}
@@ -168,9 +188,24 @@ spec:
           {{- end }}
           {{- if (eq $kubernetes.konnectivity.server.mode "GRPC") }}
         - mountPath: /run/konnectivity-server
-          name: konnectivity-uds      
+          name: konnectivity-uds
           {{- end }}
         {{- end }}
+        {{- if $kubernetes.apiServer.audit.enabled }}
+        - mountPath: /etc/kubernetes/audit/policy/
+          name: audit
+          readOnly: true
+        {{- if or (eq $kubernetes.apiServer.audit.backend "log") (eq $kubernetes.apiServer.audit.backend "both")}}
+        - mountPath: /var/log/kubernetes/audit/
+          name: audit-log
+          readOnly: false
+        {{- end }}
+        {{- if or (eq $kubernetes.apiServer.audit.backend "webhook") (eq $kubernetes.apiServer.audit.backend "both")}}
+        - mountPath: /etc/kubernetes/audit/webhook/
+          name: webhook-config
+          readOnly: true
+        {{- end }}
+        {{- end }}
         {{- with $kubernetes.apiServer.volumeMounts }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -207,6 +242,22 @@ spec:
           {{- include "kubernetes.konnectivityServer.volumes" $ | nindent 6 }}
         {{- end }}
       {{- end }}
+      {{- if $kubernetes.apiServer.audit.enabled }}
+      - configMap:
+          name: "{{ $fullName }}-audit-policy"
+        name: audit
+      {{- if or (eq $kubernetes.apiServer.audit.backend "webhook") (eq $kubernetes.apiServer.audit.backend "both")}}
+      - configMap:
+          name: "{{ $fullName }}-webhook-config"
+        name: webhook-config
+      {{- end }}
+      {{- if or (eq $kubernetes.apiServer.audit.backend "log") (eq $kubernetes.apiServer.audit.backend "both")}}
+      - name: audit-log
+        hostPath:
+          path: /var/log/kubernetes/audit/
+          type: DirectoryOrCreate
+      {{- end }}
+      {{- end }}
       {{- with $kubernetes.apiServer.volumes }}
         {{- toYaml . | nindent 6 }}
       {{- end }}
diff --git a/charts/vcluster/templates/components/kubernetes/apiserver/hpa.yaml b/charts/vcluster/templates/components/kubernetes/apiserver/hpa.yaml
index 04ed3cd..ff400ac 100644
--- a/charts/vcluster/templates/components/kubernetes/apiserver/hpa.yaml
+++ b/charts/vcluster/templates/components/kubernetes/apiserver/hpa.yaml
@@ -6,7 +6,7 @@
     {{- $manifest := $kubernetes.apiServer.autoscaling -}}
     {{- if $manifest.enabled }}
 ---
-apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: "{{ $fullName }}-apiserver"
diff --git a/charts/vcluster/templates/components/kubernetes/apiserver/networkpolicy.yaml b/charts/vcluster/templates/components/kubernetes/apiserver/networkpolicy.yaml
index c96bb8c..40122e5 100644
--- a/charts/vcluster/templates/components/kubernetes/apiserver/networkpolicy.yaml
+++ b/charts/vcluster/templates/components/kubernetes/apiserver/networkpolicy.yaml
@@ -1,4 +1,4 @@
-{{- if (include "pkg.components.netpol.enabled" $) -}} 
+{{- if (include "pkg.components.netpol.enabled" $) -}}
   {{- if (include "kubernetes.enabled" $) -}}
     {{- $kubernetes := $.Values.kubernetes -}}
     {{- if $kubernetes.apiServer.enabled }}
@@ -16,7 +16,7 @@ spec:
   podSelector:
     matchLabels:
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
-      {{- include "kubernetes.labels" $ | nindent 6 }}
+      {{- include "kubernetes.selectorLabels" $ | nindent 6 }}
   policyTypes:
   - Ingress
   ingress:
diff --git a/charts/vcluster/templates/components/kubernetes/apiserver/pdb.yaml b/charts/vcluster/templates/components/kubernetes/apiserver/pdb.yaml
index 585adad..b601067 100644
--- a/charts/vcluster/templates/components/kubernetes/apiserver/pdb.yaml
+++ b/charts/vcluster/templates/components/kubernetes/apiserver/pdb.yaml
@@ -5,7 +5,7 @@
     {{- $component_name := "apiserver" -}}
     {{- if $kubernetes.apiServer.podDisruptionBudget -}}
 ---
-apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }}
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: "{{ $fullName }}-apiserver"
@@ -14,7 +14,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec: {{- toYaml $kubernetes.apiServer.podDisruptionBudget | nindent 2 }}
   selector:
-    matchLabels: {{- include "kubernetes.labels" $ | nindent 6 }}
+    matchLabels: {{- include "kubernetes.selectorLabels" $ | nindent 6 }}
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- end -}}
   {{- end -}}
diff --git a/charts/vcluster/templates/components/kubernetes/apiserver/policy.yaml b/charts/vcluster/templates/components/kubernetes/apiserver/policy.yaml
new file mode 100644
index 0000000..4e8f36c
--- /dev/null
+++ b/charts/vcluster/templates/components/kubernetes/apiserver/policy.yaml
@@ -0,0 +1,18 @@
+{{- if (include "kubernetes.enabled" $) -}}
+  {{- $kubernetes := $.Values.kubernetes -}}
+  {{- if and $kubernetes.apiServer.enabled $kubernetes.apiServer.audit.enabled -}}
+    {{- $fullName := include "kubernetes.fullname" . -}}
+    {{- $component_name := "apiserver" -}}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $fullName }}-audit-policy
+  labels: {{- include "kubernetes.labels" $ | nindent 4 }}
+    {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
+  namespace: {{ $.Release.Namespace }}
+data:
+  policy.yaml: |
+    {{- $kubernetes.apiServer.audit.policy | nindent 4 }}
+  {{- end -}}
+{{- end -}}
diff --git a/charts/vcluster/templates/components/kubernetes/apiserver/probe.yaml b/charts/vcluster/templates/components/kubernetes/apiserver/probe.yaml
index 0aafd30..e6d8185 100644
--- a/charts/vcluster/templates/components/kubernetes/apiserver/probe.yaml
+++ b/charts/vcluster/templates/components/kubernetes/apiserver/probe.yaml
@@ -28,7 +28,7 @@ spec:
     url: {{ .url | default "blackbox-exporter-prometheus-blackbox-exporter:9115" }}
     path: {{ .path | default "/probe" }}
     scheme: {{ .scheme | default "http" }}
-    proxyUrl: {{ .proxyUrl | default ""}}
+    proxyUrl: {{ .proxyUrl | default "" | quote }}
   {{- end }}
   targets:
     staticConfig:
diff --git a/charts/vcluster/templates/components/kubernetes/apiserver/webhook.yaml b/charts/vcluster/templates/components/kubernetes/apiserver/webhook.yaml
new file mode 100644
index 0000000..b17d17d
--- /dev/null
+++ b/charts/vcluster/templates/components/kubernetes/apiserver/webhook.yaml
@@ -0,0 +1,20 @@
+{{- if (include "kubernetes.enabled" $) -}}
+  {{- $kubernetes := $.Values.kubernetes -}}
+  {{- if and $kubernetes.apiServer.enabled $kubernetes.apiServer.audit.enabled -}}
+    {{- if or (eq $kubernetes.apiServer.audit.backend "webhook") (eq $kubernetes.apiServer.audit.backend "both")}}
+    {{- $fullName := include "kubernetes.fullname" . -}}
+    {{- $component_name := "apiserver" -}}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $fullName }}-webhook-config
+  labels: {{- include "kubernetes.labels" $ | nindent 4 }}
+    {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
+  namespace: {{ $.Release.Namespace }}
+data:
+  webhook.yaml: |
+    {{- $kubernetes.apiServer.audit.webhook.config | nindent 4 }}
+  {{- end -}}
+  {{- end -}}
+{{- end -}}
diff --git a/charts/vcluster/templates/components/kubernetes/controller-manager/deployment.yaml b/charts/vcluster/templates/components/kubernetes/controller-manager/deployment.yaml
index e38b545..400ca8e 100644
--- a/charts/vcluster/templates/components/kubernetes/controller-manager/deployment.yaml
+++ b/charts/vcluster/templates/components/kubernetes/controller-manager/deployment.yaml
@@ -12,11 +12,11 @@ metadata:
     {{- include "pkg.components.svc_labels" (dict "labels" $kubernetes.controllerManager.service.labels "ctx" $) | nindent 4 }}
     {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.controllerManager.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
     {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.controllerManager.annotations "ctx" $)) }}
   annotations:
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   {{- if not $kubernetes.controllerManager.autoscaling.enabled }}
@@ -30,13 +30,14 @@ spec:
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
   template:
     metadata:
-      labels: {{- include "kubernetes.labels" $ | nindent 8 }}
+      labels: {{- include "kubernetes.selectorLabels" $ | nindent 8 }}
         {{- include "pkg.components.pod_labels" (dict "labels" $kubernetes.controllerManager.podLabels "ctx" $) | nindent 8 }}
         {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
       annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/components/kubernetes/controller-manager/configmap.yaml" ) . | sha256sum }}
         {{- include "pkg.components.pod_annotations" (dict "annotations" $kubernetes.controllerManager.podAnnotations "ctx" $) | nindent 8 }}
     spec:
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $kubernetes.controllerManager.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $kubernetes.controllerManager.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.tolerations" (dict "tolerations" $kubernetes.controllerManager.tolerations "ctx" $)) }}
diff --git a/charts/vcluster/templates/components/kubernetes/controller-manager/hpa.yaml b/charts/vcluster/templates/components/kubernetes/controller-manager/hpa.yaml
index 00e25fe..a886a04 100644
--- a/charts/vcluster/templates/components/kubernetes/controller-manager/hpa.yaml
+++ b/charts/vcluster/templates/components/kubernetes/controller-manager/hpa.yaml
@@ -6,7 +6,7 @@
     {{- $manifest := $kubernetes.controllerManager.autoscaling -}}
     {{- if $manifest.enabled }}
 ---
-apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: "{{ $fullName }}-controller-manager"
diff --git a/charts/vcluster/templates/components/kubernetes/controller-manager/pdb.yaml b/charts/vcluster/templates/components/kubernetes/controller-manager/pdb.yaml
index 586a376..21e71f3 100644
--- a/charts/vcluster/templates/components/kubernetes/controller-manager/pdb.yaml
+++ b/charts/vcluster/templates/components/kubernetes/controller-manager/pdb.yaml
@@ -5,7 +5,7 @@
     {{- $component_name := "controller-manager" -}}
     {{- if $kubernetes.controllerManager.podDisruptionBudget -}}
 ---
-apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }}
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: "{{ $fullName }}-controller-manager"
@@ -14,7 +14,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec: {{- toYaml $kubernetes.controllerManager.podDisruptionBudget | nindent 2 }}
   selector:
-    matchLabels: {{- include "kubernetes.labels" $ | nindent 6 }}
+    matchLabels: {{- include "kubernetes.selectorLabels" $ | nindent 6 }}
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- end -}}
   {{- end -}}
diff --git a/charts/vcluster/templates/components/kubernetes/etcd/backup-job.yaml b/charts/vcluster/templates/components/kubernetes/etcd/backup-job.yaml
index 1af55e5..6a76d57 100644
--- a/charts/vcluster/templates/components/kubernetes/etcd/backup-job.yaml
+++ b/charts/vcluster/templates/components/kubernetes/etcd/backup-job.yaml
@@ -39,23 +39,23 @@ spec:
       {{- end }}
       template:
         metadata:
-          labels: {{- include "kubernetes.labels" $ | nindent 12 }}
+          labels: {{- include "kubernetes.selectorLabels" $ | nindent 12 }}
             {{- include "pkg.components.pod_labels" (dict "labels" $kubernetes.etcd.backup.podLabels "ctx" $) | nindent 12 }}
             {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
           annotations:
             {{- include "pkg.components.pod_annotations" (dict "annotations" $kubernetes.etcd.backup.podAnnotations "ctx" $) | nindent 12 }}
         spec:
-          {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $kubernetes.etcd.backup.nodeSelector "ctx" $)) }}
-          nodeSelector: {{- . | nindent 10 }}
+          {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $kubernetes.etcd.backup.nodeSelector "ctx" $)) }}
+          nodeSelector: {{- . | nindent 12 }}
           {{- end }}
           {{- with (include "pkg.components.tolerations" (dict "tolerations" $kubernetes.etcd.backup.tolerations "ctx" $)) }}
-          tolerations:  {{- . | nindent 10 }}
+          tolerations:  {{- . | nindent 12 }}
           {{- end }}
           {{- with (include "pkg.components.priorityClass" (dict "pc" $kubernetes.etcd.backup.priorityClassName "ctx" $)) }}
           priorityClassName: {{ . }}
           {{- end }}
           {{- with (include "pkg.components.topologySpreadConstraints" (dict "tsc" $kubernetes.etcd.backup.topologySpreadConstraints "ctx" $)) }}
-          topologySpreadConstraints: {{ . | nindent 10 }}
+          topologySpreadConstraints: {{ . | nindent 12 }}
           {{- end }}
           affinity:
           {{- with (include "pkg.components.affinity" (dict "affinity" $kubernetes.etcd.backup.affinity "ctx" $)) }}
@@ -96,20 +96,18 @@ spec:
             envFrom:
               {{- toYaml . | nindent 12 }}
             {{- end }}
-            env: 
+            env:
             {{- if $kubernetes.etcd.backup.injectProxy }}
               {{- include "pkg.common.env.w-proxy" $ | nindent 12 }}
             {{- else }}
               {{- include "pkg.common.env" $ | nindent 12 }}
             {{- end }}
-            - name: ETCDCTL_API
-              value: "3"
             - name: ETCDCTL_CACERT
               value: /pki/etcd/peer/ca.crt
             - name: ETCDCTL_CERT
               value: /pki/etcd/peer/tls.crt
             - name: ETCDCTL_KEY
-              value: /pki/etcd/peer/tls.key 
+              value: /pki/etcd/peer/tls.key
             - name: ETCDCTL_ENDPOINTS
               value: {{ $fullName }}-etcd:{{ $kubernetes.etcd.ports.client }}
             {{- with $kubernetes.etcd.backup.envs }}
@@ -151,7 +149,7 @@ spec:
               secretName: {{ $fullName }}-pki-etcd-server
             name: pki-etcd-certs-server
           - name: snapshots
-            persistentVolumeClaim: 
+            persistentVolumeClaim:
               claimName: {{ $kubernetes.etcd.backup.persistence.existingClaim | default (printf "%s-etcd-backup" $fullName) }}
           {{- with $kubernetes.etcd.backup.volumes }}
             {{- toYaml . | nindent 10 }}
diff --git a/charts/vcluster/templates/components/kubernetes/etcd/backup-pvc.yaml b/charts/vcluster/templates/components/kubernetes/etcd/backup-pvc.yaml
index 0b83518..a948d69 100644
--- a/charts/vcluster/templates/components/kubernetes/etcd/backup-pvc.yaml
+++ b/charts/vcluster/templates/components/kubernetes/etcd/backup-pvc.yaml
@@ -13,11 +13,11 @@ metadata:
     {{- if $kubernetes.etcd.backup.persistence.labels }}
       {{- toYaml $kubernetes.etcd.backup.persistence.labels | nindent 4 }}
     {{- end }}
-  {{- with $kubernetes.etcd.backup.persistence.annotations  }}
+  {{- with $kubernetes.etcd.backup.persistence.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
-  {{- with $kubernetes.etcd.backup.persistence.finalizers  }}
+  {{- with $kubernetes.etcd.backup.persistence.finalizers }}
   finalizers:
     {{- toYaml . | nindent 4 }}
   {{- end }}
@@ -34,4 +34,4 @@ spec:
     requests:
       storage: {{ $kubernetes.etcd.backup.persistence.size | quote }}
   {{- end -}}
-{{- end -}}
\ No newline at end of file
+{{- end -}}
diff --git a/charts/vcluster/templates/components/kubernetes/etcd/cleanup-job.yaml b/charts/vcluster/templates/components/kubernetes/etcd/cleanup-job.yaml
new file mode 100644
index 0000000..d8b2d5c
--- /dev/null
+++ b/charts/vcluster/templates/components/kubernetes/etcd/cleanup-job.yaml
@@ -0,0 +1,141 @@
+{{- if (include "kubernetes.enabled" $) -}}
+  {{- $kubernetes := $.Values.kubernetes -}}
+  {{- if and $kubernetes.etcd.enabled $kubernetes.etcd.cleanup.enabled -}}
+    {{- $fullName := include "kubernetes.fullname" . -}}
+    {{- $component_name := "etcd" -}}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ $fullName }}-etcd-cleanup
+  labels: {{- include "kubernetes.labels" $ | nindent 4 }}
+    {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
+    {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.etcd.cleanup.labels "ctx" $)) }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.etcd.cleanup.annotations "ctx" $)) }}
+  annotations:
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  namespace: {{ $.Release.Namespace }}
+spec:
+  schedule: "{{ $kubernetes.etcd.cleanup.schedule }}"
+  successfulJobsHistoryLimit: {{ $kubernetes.etcd.cleanup.successfulJobsHistoryLimit }}
+  failedJobsHistoryLimit: {{ $kubernetes.etcd.cleanup.failedJobsHistoryLimit }}
+  jobTemplate:
+    metadata:
+      labels:
+        {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
+        {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.etcd.cleanup.labels "ctx" $)) }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.etcd.cleanup.annotations "ctx" $)) }}
+      annotations:
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with $kubernetes.etcd.cleanup.ttlSecondsAfterFinished }}
+      ttlSecondsAfterFinished: {{ . }}
+      {{- end }}
+      template:
+        metadata:
+          labels: {{- include "kubernetes.selectorLabels" $ | nindent 12 }}
+            {{- include "pkg.components.pod_labels" (dict "labels" $kubernetes.etcd.cleanup.podLabels "ctx" $) | nindent 12 }}
+            {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
+          annotations:
+            {{- include "pkg.components.pod_annotations" (dict "annotations" $kubernetes.etcd.cleanup.podAnnotations "ctx" $) | nindent 12 }}
+        spec:
+          {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $kubernetes.etcd.cleanup.nodeSelector "ctx" $)) }}
+          nodeSelector: {{- . | nindent 12 }}
+          {{- end }}
+          {{- with (include "pkg.components.tolerations" (dict "tolerations" $kubernetes.etcd.cleanup.tolerations "ctx" $)) }}
+          tolerations:  {{- . | nindent 12 }}
+          {{- end }}
+          {{- with (include "pkg.components.priorityClass" (dict "pc" $kubernetes.etcd.cleanup.priorityClassName "ctx" $)) }}
+          priorityClassName: {{ . }}
+          {{- end }}
+          {{- with (include "pkg.components.topologySpreadConstraints" (dict "tsc" $kubernetes.etcd.cleanup.topologySpreadConstraints "ctx" $)) }}
+          topologySpreadConstraints: {{ . | nindent 12 }}
+          {{- end }}
+          affinity:
+          {{- with (include "pkg.components.affinity" (dict "affinity" $kubernetes.etcd.cleanup.affinity "ctx" $)) }}
+            {{- . | nindent 10 }}
+          {{- end }}
+          {{- if eq $kubernetes.etcd.cleanup.podAntiAffinity "hard" }}
+            podAntiAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                - topologyKey: "{{ $kubernetes.etcd.cleanup.podAntiAffinityTopologyKey }}"
+                  labelSelector:
+                    matchLabels:
+                      app: {{ $fullName }}-etcd
+          {{- else if eq $kubernetes.etcd.cleanup.podAntiAffinity "soft" }}
+            podAntiAffinity:
+              preferredDuringSchedulingIgnoredDuringExecution:
+                - weight: 1
+                  podAffinityTerm:
+                    topologyKey: "{{ $kubernetes.etcd.cleanup.podAntiAffinityTopologyKey }}"
+                    labelSelector:
+                      matchLabels:
+                        app: {{ $fullName }}-etcd
+          {{- end }}
+          imagePullSecrets: {{- include "pkg.images.registry.pullsecrets" $ | nindent 10 }}
+            {{- with $kubernetes.etcd.cleanup.imagePullSecrets }}
+              {{- toYaml . | nindent 10 }}
+            {{- end }}
+          automountServiceAccountToken: false
+          restartPolicy: {{ $kubernetes.etcd.cleanup.restartPolicy }}
+          containers:
+          - command:
+            - /bin/sh
+            - -xc
+            - |
+              SNAPSHOT_DIR="/snapshots"
+              echo "Starting snapshot cleanup..."
+              echo "Retention: $ETCD_SNAPSHOT_RETENTION_DAYS day(s)"
+              echo "Snapshot directory: $SNAPSHOT_DIR"
+              if [ -d "$SNAPSHOT_DIR" ]; then
+                find "$SNAPSHOT_DIR" -name '*.db' -type f -mtime +"$ETCD_SNAPSHOT_RETENTION_DAYS" -print -delete
+              else
+                echo "Snapshot directory $SNAPSHOT_DIR not found!"
+                exit 1
+              fi
+            {{- with $kubernetes.etcd.cleanup.envsFrom }}
+            envFrom:
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+            env:
+            - name: ETCD_SNAPSHOT_RETENTION_DAYS
+              value: {{ $kubernetes.etcd.cleanup.retentionDays | quote }}
+            {{- if $kubernetes.etcd.cleanup.injectProxy }}
+              {{- include "pkg.common.env.w-proxy" $ | nindent 12 }}
+            {{- else }}
+              {{- include "pkg.common.env" $ | nindent 12 }}
+            {{- end }}
+            {{- with $kubernetes.etcd.cleanup.envs }}
+              {{- include "pkg.utils.envs" (dict "envs" . "ctx" $) | nindent 12 }}
+            {{- end }}
+            {{- with $kubernetes.etcd.cleanup.image }}
+            image: {{ include "pkg.images.registry.convert" (dict "image" . "ctx" $) }}
+            imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" .pullPolicy "ctx" $) }}
+            {{- end }}
+            name: etcd-cleanup
+            {{- with (include "pkg.components.securityContext" (dict "sc" $kubernetes.etcd.cleanup.securityContext "ctx" $)) }}
+            securityContext: {{ . | nindent 14 }}
+            {{- end }}
+            resources:
+              {{- toYaml $kubernetes.etcd.cleanup.resources | nindent 14 }}
+            volumeMounts:
+            - mountPath: /snapshots
+              name: snapshots
+              {{- with $kubernetes.etcd.backup.persistence.subPath }}
+              subPath: {{ . }}
+              {{- end }}
+          {{- with (include "pkg.components.podSecurityContext" (dict "psc" $kubernetes.etcd.cleanup.podSecurityContext "ctx" $)) }}
+          securityContext: {{ . | nindent 12 }}
+          {{- end }}
+          volumes:
+          - name: snapshots
+            persistentVolumeClaim:
+              claimName: {{ $kubernetes.etcd.backup.persistence.existingClaim | default (printf "%s-etcd-backup" $fullName) }}
+  {{- end -}}
+{{- end -}}
diff --git a/charts/vcluster/templates/components/kubernetes/etcd/defrag-job.yaml b/charts/vcluster/templates/components/kubernetes/etcd/defrag-job.yaml
new file mode 100644
index 0000000..d47b00e
--- /dev/null
+++ b/charts/vcluster/templates/components/kubernetes/etcd/defrag-job.yaml
@@ -0,0 +1,132 @@
+{{- if (include "kubernetes.enabled" $) -}}
+  {{- $kubernetes := $.Values.kubernetes -}}
+  {{- if and $kubernetes.etcd.enabled $kubernetes.etcd.defrag.enabled -}}
+    {{- $fullName := include "kubernetes.fullname" . -}}
+    {{- $component_name := "etcd" -}}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ $fullName }}-etcd-defrag
+  labels: {{- include "kubernetes.labels" $ | nindent 4 }}
+    {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
+    {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.etcd.defrag.labels "ctx" $)) }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.etcd.defrag.annotations "ctx" $)) }}
+  annotations:
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  namespace: {{ $.Release.Namespace }}
+spec:
+  schedule: "{{ $kubernetes.etcd.defrag.schedule }}"
+  successfulJobsHistoryLimit: {{ $kubernetes.etcd.defrag.successfulJobsHistoryLimit }}
+  failedJobsHistoryLimit: {{ $kubernetes.etcd.defrag.failedJobsHistoryLimit }}
+  jobTemplate:
+    metadata:
+      labels:
+        {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
+        {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.etcd.defrag.labels "ctx" $)) }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.etcd.defrag.annotations "ctx" $)) }}
+      annotations:
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with $kubernetes.etcd.defrag.ttlSecondsAfterFinished }}
+      ttlSecondsAfterFinished: {{ . }}
+      {{- end }}
+      template:
+        metadata:
+          labels: {{- include "kubernetes.selectorLabels" $ | nindent 12 }}
+            {{- include "pkg.components.pod_labels" (dict "labels" $kubernetes.etcd.defrag.podLabels "ctx" $) | nindent 12 }}
+            {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
+          annotations:
+            {{- include "pkg.components.pod_annotations" (dict "annotations" $kubernetes.etcd.defrag.podAnnotations "ctx" $) | nindent 12 }}
+        spec:
+          {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $kubernetes.etcd.defrag.nodeSelector "ctx" $)) }}
+          nodeSelector: {{- . | nindent 12 }}
+          {{- end }}
+          {{- with (include "pkg.components.tolerations" (dict "tolerations" $kubernetes.etcd.defrag.tolerations "ctx" $)) }}
+          tolerations:  {{- . | nindent 12 }}
+          {{- end }}
+          {{- with (include "pkg.components.priorityClass" (dict "pc" $kubernetes.etcd.defrag.priorityClassName "ctx" $)) }}
+          priorityClassName: {{ . }}
+          {{- end }}
+          {{- with (include "pkg.components.topologySpreadConstraints" (dict "tsc" $kubernetes.etcd.defrag.topologySpreadConstraints "ctx" $)) }}
+          topologySpreadConstraints: {{ . | nindent 12 }}
+          {{- end }}
+          affinity:
+          {{- with (include "pkg.components.affinity" (dict "affinity" $kubernetes.etcd.defrag.affinity "ctx" $)) }}
+            {{- . | nindent 10 }}
+          {{- end }}
+          {{- if eq $kubernetes.etcd.defrag.podAntiAffinity "hard" }}
+            podAntiAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                - topologyKey: "{{ $kubernetes.etcd.defrag.podAntiAffinityTopologyKey }}"
+                  labelSelector:
+                    matchLabels:
+                      app: {{ $fullName }}-etcd
+          {{- else if eq $kubernetes.etcd.defrag.podAntiAffinity "soft" }}
+            podAntiAffinity:
+              preferredDuringSchedulingIgnoredDuringExecution:
+                - weight: 1
+                  podAffinityTerm:
+                    topologyKey: "{{ $kubernetes.etcd.defrag.podAntiAffinityTopologyKey }}"
+                    labelSelector:
+                      matchLabels:
+                        app: {{ $fullName }}-etcd
+          {{- end }}
+          imagePullSecrets: {{- include "pkg.images.registry.pullsecrets" $ | nindent 10 }}
+            {{- with $kubernetes.etcd.defrag.imagePullSecrets }}
+              {{- toYaml . | nindent 10 }}
+            {{- end }}
+          automountServiceAccountToken: false
+          restartPolicy: {{ $kubernetes.etcd.defrag.restartPolicy }}
+          containers:
+          - args:
+            - --endpoints={{ template "kubernetes.etcdCtlEndpoints" . }}
+            - --cacert=/pki/etcd/peer/ca.crt
+            - --cert=/pki/etcd/peer/tls.crt
+            - --key=/pki/etcd/peer/tls.key
+            - --cluster
+            - --defrag-rule
+            {{- with $kubernetes.etcd.defrag.defragRule }}
+            - {{ . | quote }}
+            {{- end }}
+            {{- with $kubernetes.etcd.defrag.envsFrom }}
+            envFrom:
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+            env:
+            {{- if $kubernetes.etcd.defrag.injectProxy }}
+              {{- include "pkg.common.env.w-proxy" $ | nindent 12 }}
+            {{- else }}
+              {{- include "pkg.common.env" $ | nindent 12 }}
+            {{- end }}
+            {{- with $kubernetes.etcd.defrag.envs }}
+              {{- include "pkg.utils.envs" (dict "envs" . "ctx" $) | nindent 12 }}
+            {{- end }}
+            {{- with $kubernetes.etcd.defrag.image }}
+            image: {{ include "pkg.images.registry.convert" (dict "image" . "ctx" $) }}
+            imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" .pullPolicy "ctx" $) }}
+            {{- end }}
+            name: etcd-defrag
+            {{- with (include "pkg.components.securityContext" (dict "sc" $kubernetes.etcd.defrag.securityContext "ctx" $)) }}
+            securityContext: {{ . | nindent 14 }}
+            {{- end }}
+            resources:
+              {{- toYaml $kubernetes.etcd.defrag.resources | nindent 14 }}
+            volumeMounts:
+            - mountPath: /pki/etcd/peer
+              name: pki-etcd-certs-peer
+          {{- with (include "pkg.components.podSecurityContext" (dict "psc" $kubernetes.etcd.defrag.podSecurityContext "ctx" $)) }}
+          securityContext: {{ . | nindent 12 }}
+          {{- end }}
+          volumes:
+          - secret:
+              secretName: {{ $fullName }}-pki-etcd-peer
+            name: pki-etcd-certs-peer
+  {{- end -}}
+{{- end -}}
diff --git a/charts/vcluster/templates/components/kubernetes/etcd/pdb.yaml b/charts/vcluster/templates/components/kubernetes/etcd/pdb.yaml
index 436aa8b..64c36bc 100644
--- a/charts/vcluster/templates/components/kubernetes/etcd/pdb.yaml
+++ b/charts/vcluster/templates/components/kubernetes/etcd/pdb.yaml
@@ -5,7 +5,7 @@
     {{- $component_name := "etcd" -}}
     {{- if $kubernetes.etcd.podDisruptionBudget -}}
 ---
-apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }}
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: "{{ $fullName }}-etcd"
@@ -14,7 +14,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec: {{- toYaml $kubernetes.etcd.podDisruptionBudget | nindent 2 }}
   selector:
-    matchLabels: {{- include "kubernetes.labels" $ | nindent 6 }}
+    matchLabels: {{- include "kubernetes.selectorLabels" $ | nindent 6 }}
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- end -}}
   {{- end -}}
diff --git a/charts/vcluster/templates/components/kubernetes/etcd/statefulset.yaml b/charts/vcluster/templates/components/kubernetes/etcd/statefulset.yaml
index 3b99328..b490cf6 100644
--- a/charts/vcluster/templates/components/kubernetes/etcd/statefulset.yaml
+++ b/charts/vcluster/templates/components/kubernetes/etcd/statefulset.yaml
@@ -8,11 +8,11 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: {{ $fullName }}-etcd
-  labels: 
+  labels:
     {{- include "kubernetes.labels" $ | nindent 4 }}
     {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.etcd.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
     {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.etcd.annotations "ctx" $)) }}
   annotations:
@@ -37,13 +37,13 @@ spec:
   template:
     metadata:
       name: {{ $fullName }}-etcd
-      labels: {{- include "kubernetes.labels" $ | nindent 8 }}
+      labels: {{- include "kubernetes.selectorLabels" $ | nindent 8 }}
         {{- include "pkg.components.pod_labels" (dict "labels" $kubernetes.etcd.podLabels "ctx" $) | nindent 8 }}
         {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
       annotations:
         {{- include "pkg.components.pod_annotations" (dict "annotations" $kubernetes.etcd.podAnnotations "ctx" $) | nindent 8 }}
     spec:
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $kubernetes.etcd.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $kubernetes.etcd.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.tolerations" (dict "tolerations" $kubernetes.etcd.tolerations "ctx" $)) }}
@@ -109,14 +109,12 @@ spec:
         envFrom:
           {{- toYaml . | nindent 8 }}
         {{- end }}
-        env: 
+        env:
         {{- if $kubernetes.etcd.injectProxy }}
           {{- include "pkg.common.env.w-proxy" $ | nindent 8 }}
         {{- else }}
           {{- include "pkg.common.env" $ | nindent 8 }}
         {{- end }}
-        - name: ETCDCTL_API
-          value: "3"
         - name: ETCDCTL_CACERT
           value: /pki/etcd/peer/ca.crt
         - name: ETCDCTL_CERT
@@ -124,7 +122,7 @@ spec:
         - name: ETCDCTL_KEY
           value: /pki/etcd/peer/tls.key
         - name: ETCDCTL_ENDPOINTS
-          value: {{ template "kubernetes.etcdEndpoints" . }}
+          value: {{ template "kubernetes.etcdCtlEndpoints" . }}
         {{- with $kubernetes.etcd.envs }}
           {{- include "pkg.utils.envs" (dict "envs" . "ctx" $) | nindent 8 }}
         {{- end }}
@@ -143,13 +141,21 @@ spec:
         - containerPort: {{ $kubernetes.etcd.ports.metrics }}
           name: http-metrics
         livenessProbe:
-          failureThreshold: 8
+          failureThreshold: {{ $kubernetes.etcd.livenessProbe.failureThreshold }}
+          httpGet:
+            path: {{ $kubernetes.etcd.livenessProbe.path | quote }}
+            port: {{ $kubernetes.etcd.ports.metrics }}
+            scheme: {{ $kubernetes.etcd.livenessProbe.scheme | quote }}
+          initialDelaySeconds: {{ $kubernetes.etcd.livenessProbe.initialDelaySeconds }}
+          timeoutSeconds: {{ $kubernetes.etcd.livenessProbe.timeoutSeconds }}
+        readinessProbe:
+          failureThreshold: {{ $kubernetes.etcd.readinessProbe.failureThreshold }}
           httpGet:
-            path: /health
+            path: {{ $kubernetes.etcd.readinessProbe.path | quote }}
             port: {{ $kubernetes.etcd.ports.metrics }}
-            scheme: HTTP
-          initialDelaySeconds: 15
-          timeoutSeconds: 15
+            scheme: {{ $kubernetes.etcd.readinessProbe.scheme | quote }}
+          initialDelaySeconds: {{ $kubernetes.etcd.readinessProbe.initialDelaySeconds }}
+          timeoutSeconds: {{ $kubernetes.etcd.readinessProbe.timeoutSeconds }}
         name: etcd
         resources:
           {{- toYaml $kubernetes.etcd.resources | nindent 10 }}
@@ -191,7 +197,7 @@ spec:
       {{- end }}
       {{- if and $kubernetes.etcd.backup.enabled $kubernetes.etcd.backup.persistence.mountOnETCD }}
       - name: snapshots
-        persistentVolumeClaim: 
+        persistentVolumeClaim:
           claimName: {{ $kubernetes.etcd.backup.persistence.existingClaim | default (printf "%s-etcd-backup" $fullName) }}
       {{- end }}
       {{- with $kubernetes.etcd.volumes }}
@@ -206,11 +212,11 @@ spec:
         {{- if $kubernetes.etcd.persistence.labels }}
         {{- toYaml $kubernetes.etcd.persistence.labels | nindent 4 }}
         {{- end }}
-      {{- with $kubernetes.etcd.persistence.annotations  }}
+      {{- with $kubernetes.etcd.persistence.annotations }}
       annotations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with $kubernetes.etcd.persistence.finalizers  }}
+      {{- with $kubernetes.etcd.persistence.finalizers }}
       finalizers:
         {{- toYaml . | nindent 8 }}
       {{- end }}
diff --git a/charts/vcluster/templates/components/kubernetes/konnectivity/deployment.yaml b/charts/vcluster/templates/components/kubernetes/konnectivity/deployment.yaml
index d00cbe1..78da7f4 100644
--- a/charts/vcluster/templates/components/kubernetes/konnectivity/deployment.yaml
+++ b/charts/vcluster/templates/components/kubernetes/konnectivity/deployment.yaml
@@ -13,11 +13,11 @@ metadata:
   labels: {{- include "kubernetes.labels" $ | nindent 4 }}
     {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.konnectivity.server.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
     {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.konnectivity.server.annotations "ctx" $)) }}
   annotations:
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   replicas: {{ $kubernetes.konnectivity.server.replicaCount }}
@@ -29,13 +29,13 @@ spec:
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
   template:
     metadata:
-      labels: {{- include "kubernetes.labels" $ | nindent 8 }}
+      labels: {{- include "kubernetes.selectorLabels" $ | nindent 8 }}
         {{- include "pkg.components.pod_labels" (dict "labels" $kubernetes.konnectivity.server.podLabels "ctx" $) | nindent 8 }}
         {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
       annotations:
         {{- include "pkg.components.pod_annotations" (dict "annotations" $kubernetes.konnectivity.server.podAnnotations "ctx" $) | nindent 8 }}
     spec:
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $kubernetes.konnectivity.server.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $kubernetes.konnectivity.server.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.tolerations" (dict "tolerations" $kubernetes.konnectivity.server.tolerations "ctx" $)) }}
@@ -79,7 +79,7 @@ spec:
       containers:
         {{- include "kubernetes.konnectivityServer.containers" $ | nindent 8 }}
       volumes:
-        {{- include  "kubernetes.konnectivityServer.volumes" $ | nindent 8 }}
+        {{- include "kubernetes.konnectivityServer.volumes" $ | nindent 8 }}
     {{- end -}}
   {{- end -}}
 {{- end -}}
diff --git a/charts/vcluster/templates/components/kubernetes/konnectivity/networkpolicy.yaml b/charts/vcluster/templates/components/kubernetes/konnectivity/networkpolicy.yaml
index 6a9100c..e0af172 100644
--- a/charts/vcluster/templates/components/kubernetes/konnectivity/networkpolicy.yaml
+++ b/charts/vcluster/templates/components/kubernetes/konnectivity/networkpolicy.yaml
@@ -1,4 +1,4 @@
-{{- if (include "pkg.components.netpol.enabled" $) -}} 
+{{- if (include "pkg.components.netpol.enabled" $) -}}
   {{- if (include "kubernetes.enabled" $) -}}
     {{- $kubernetes := $.Values.kubernetes -}}
     {{- if and $kubernetes.konnectivity.enabled $kubernetes.konnectivity.server.enabled -}}
@@ -16,7 +16,7 @@ spec:
   podSelector:
     matchLabels:
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
-      {{- include "kubernetes.labels" $ | nindent 6 }}
+      {{- include "kubernetes.selectorLabels" $ | nindent 6 }}
   policyTypes:
   - Ingress
   ingress:
diff --git a/charts/vcluster/templates/components/kubernetes/kubeadm-config.yaml b/charts/vcluster/templates/components/kubernetes/kubeadm-config.yaml
index e643058..b16f400 100644
--- a/charts/vcluster/templates/components/kubernetes/kubeadm-config.yaml
+++ b/charts/vcluster/templates/components/kubernetes/kubeadm-config.yaml
@@ -15,8 +15,8 @@ data:
     apiVersion: kubeadm.k8s.io/v1beta3
     kind: ClusterConfiguration
     clusterName: {{ include "pkg.cluster.name" $ }}
-    {{- if $kubernetes.controlPlaneEndpoint }}
-    controlPlaneEndpoint: {{ $kubernetes.controlPlaneEndpoint }}
+    {{- if $kubernetes.controlPlane.endpoint }}
+    controlPlaneEndpoint: {{ $kubernetes.controlPlane.endpoint }}
     {{- else }}
     controlPlaneEndpoint: {{ include "kubernetes.api.service" $ }}:{{ $kubernetes.apiServer.service.port }}
     {{- end }}
diff --git a/charts/vcluster/templates/components/kubernetes/scheduler/deployment.yaml b/charts/vcluster/templates/components/kubernetes/scheduler/deployment.yaml
index a5ffbad..88e5c87 100644
--- a/charts/vcluster/templates/components/kubernetes/scheduler/deployment.yaml
+++ b/charts/vcluster/templates/components/kubernetes/scheduler/deployment.yaml
@@ -11,11 +11,11 @@ metadata:
   labels: {{- include "kubernetes.labels" $ | nindent 4 }}
     {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- with (include "pkg.components.labels" (dict "labels" $kubernetes.scheduler.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
     {{- with (include "pkg.components.annotations" (dict "annotations" $kubernetes.scheduler.annotations "ctx" $)) }}
   annotations:
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   {{- if not $kubernetes.scheduler.autoscaling.enabled }}
@@ -29,13 +29,14 @@ spec:
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
   template:
     metadata:
-      labels: {{- include "kubernetes.labels" $ | nindent 8 }}
+      labels: {{- include "kubernetes.selectorLabels" $ | nindent 8 }}
         {{- include "pkg.components.pod_labels" (dict "labels" $kubernetes.scheduler.podLabels "ctx" $) | nindent 8 }}
         {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
       annotations:
         {{- include "pkg.components.pod_annotations" (dict "annotations" $kubernetes.scheduler.podAnnotations "ctx" $) | nindent 8 }}
+        checksum/config: {{ include (print $.Template.BasePath "/components/kubernetes/scheduler/configmap.yaml" ) . | sha256sum }}
     spec:
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $kubernetes.scheduler.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $kubernetes.scheduler.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.tolerations" (dict "tolerations" $kubernetes.scheduler.tolerations "ctx" $)) }}
@@ -112,7 +113,7 @@ spec:
         envFrom:
           {{- toYaml . | nindent 8 }}
         {{- end }}
-        env: 
+        env:
         {{- if $kubernetes.scheduler.injectProxy }}
           {{- include "pkg.common.env.w-proxy" $ | nindent 8 }}
         {{- else }}
diff --git a/charts/vcluster/templates/components/kubernetes/scheduler/hpa.yaml b/charts/vcluster/templates/components/kubernetes/scheduler/hpa.yaml
index 3e44e4d..3a852fd 100644
--- a/charts/vcluster/templates/components/kubernetes/scheduler/hpa.yaml
+++ b/charts/vcluster/templates/components/kubernetes/scheduler/hpa.yaml
@@ -6,7 +6,7 @@
     {{- $manifest := $kubernetes.scheduler.autoscaling -}}
     {{- if $manifest.enabled }}
 ---
-apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: "{{ $fullName }}-scheduler"
diff --git a/charts/vcluster/templates/components/kubernetes/scheduler/pdb.yaml b/charts/vcluster/templates/components/kubernetes/scheduler/pdb.yaml
index 21ac7e4..e8374b1 100644
--- a/charts/vcluster/templates/components/kubernetes/scheduler/pdb.yaml
+++ b/charts/vcluster/templates/components/kubernetes/scheduler/pdb.yaml
@@ -5,7 +5,7 @@
     {{- $component_name := "scheduler" -}}
     {{- if $kubernetes.scheduler.podDisruptionBudget -}}
 ---
-apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }}
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: "{{ $fullName }}-scheduler"
@@ -14,7 +14,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec: {{- toYaml $kubernetes.scheduler.podDisruptionBudget | nindent 2 }}
   selector:
-    matchLabels: {{- include "kubernetes.labels" $ | nindent 6 }}
+    matchLabels: {{- include "kubernetes.selectorLabels" $ | nindent 6 }}
       {{ include "pkg.common.labels.component" $ }}: {{ $component_name }}
     {{- end -}}
   {{- end -}}
diff --git a/charts/vcluster/templates/components/machine-controller/_templates.tpl b/charts/vcluster/templates/components/machine-controller/_templates.tpl
index 689ec10..da131e5 100644
--- a/charts/vcluster/templates/components/machine-controller/_templates.tpl
+++ b/charts/vcluster/templates/components/machine-controller/_templates.tpl
@@ -23,7 +23,7 @@ Component Manifests directory
 {{- end }}
 
 {{/*
-Component Manifests directory
+Component Manifests
 */}}
 {{- define "machine-controller.manifests" -}}
 {{- printf "%s/**.yaml" (include "machine-controller.manifests.dir" $) -}}
@@ -36,9 +36,8 @@ Component Webhook directory
 {{- printf "webhooks/%s" (include "machine-controller.component" $) -}}
 {{- end }}
 
-
 {{/*
-Component Webhook directory
+Component Webhook
 */}}
 {{- define "machine-controller.webhooks" -}}
 {{- printf "%s/**.yaml" (include "machine-controller.webhooks.dir" $) -}}
@@ -51,13 +50,6 @@ Component Webhook directory
 machine-controller
 {{- end }}
 
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "machine-controller.name" -}}
-{{- include "machine-controller.component" $ -}}
-{{- end }}
-
 {{/*
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
@@ -109,7 +101,6 @@ Create the name of the service account to use
   {{- end -}}
 {{- end -}}
 
-
 {{/*
 Create the Admission Webhook TLS Secret
 */}}
@@ -148,50 +139,9 @@ checksum/webhooks: {{ (.Files.Glob (include "machine-controller.webhooks" $) | t
 */}}
 {{- define "machine-controller.controller.args" -}}
 - -kubeconfig={{ include "pkg.cluster.cp.env.mount" $ }}
-  {{- if (include "pkg.common.proxy.enabled" $) }}
-    {{- with (include "pkg.common.proxy.host" $) }}
-- -node-http-proxy={{ . }}
-      {{- with (include "pkg.common.proxy.no_proxy" $) }}
-- -node-no-proxy={{ . | quote }}
-      {{- end }}
-    {{- end }}
-  {{- end }}
-  {{- if (include "pkg.images.registry.set" $) }}
-- -node-registry-mirrors={{ include "pkg.images.registry.url" $ }}
-#- -node-containerd-registry-mirrors
-    {{- if (include "pkg.images.registry.auth" $) }}
-- -node-registry-credentials-secret={{ include "pkg.images.registry.secretnamespace" $ }}/regcreds
-    {{- end }}
-  {{- end }}
-- -cluster-dns={{ include "kubernetes.getCoreDNS" $ }}
 - -override-bootstrap-kubelet-apiserver={{ include "kubernetes.api.endpoint" $ }}
-  {{- with $.Values.machine.kubelet.featureGates }}
-- -node-kubelet-feature-gates={{ . | join "," | quote }}
-  {{- end }}
 {{- end -}}
 
-{{/*
-    Pause Image / OSM Compatible
-*/}}
-{{- define "machine-controller.pause" -}}
-{{- $machine := $.Values.machine -}}
-  {{- with $machine.pause }}
-    {{- include "pkg.images.registry.convert" (dict "image" .image "ctx" $) -}}
-  {{- end }}
-{{- end }}
-
-
-{{/*
-    Runtime / OSM Compatible
-*/}}
-{{- define "machine-controller.runtime" -}}
-{{- $machine := $.Values.machine -}}
-  {{- with $machine.runtime }}
-    {{- printf "%s" . -}}
-  {{- end }}
-{{- end }}
-
-
 {{/*
 Create the Admission Webhook Name
 */}}
@@ -212,7 +162,7 @@ machine-controller-mutating-webhook
     {{- if (include "machine-controller.admission.expose.ingress" $) -}}
       {{- $base = (printf "https://%s/%s" (include "pkg.components.ingress.host" $) (include "machine-controller.admission.expose.ingress.context" $ | trimPrefix "/")) -}}
     {{- end -}}
-  
+
     {{/* Expose via Service (LoadBalancer) */}}
     {{- if (include "machine-controller.admission.expose.loadbalancer" $) -}}
       {{- $base = (printf "https://%s:%s" (include "machine-controller.admission.expose.loadbalancer.ip" $) (include "machine-controller.admission.expose.loadbalancer.port" $)) -}}
@@ -250,7 +200,6 @@ Admission Expose
   {{- end -}}
 {{- end -}}
 
-
 {{- define "machine-controller.admission.expose.loadbalancer.ip" -}}
   {{- $machine := $.Values.machine -}}
   {{- with $machine.admission.service.loadBalancerIP -}}
@@ -277,7 +226,6 @@ Admission Expose
   {{- printf "%s" (required "Context Required" $machine.admission.ingress.contextPath) -}}
 {{- end -}}
 
-
 {{/* Volumes for Admission Pod */}}
 {{- define "machine-controller.volumes" -}}
 - name: machine-webhooks
@@ -287,7 +235,7 @@ Admission Expose
 - name: machine-manifests
   secret:
     defaultMode: 420
-    secretName: {{ include "machine-controller.manifests.name" $  }}
+    secretName: {{ include "machine-controller.manifests.name" $ }}
   {{- if (include "machine-controller.admission-enabled" $) }}
 - name: machine-webhook-certs
   secret:
@@ -339,7 +287,6 @@ Admission Expose
   {{- include "machine-controller.admission.webhook-cert-patch" $ | nindent 0 }}
 {{- end -}}
 
-
 {{/*
   Ensure Manifests
 */}}
@@ -373,13 +320,14 @@ fi
   InitContainer to apply/delete manifests
 */}}
 {{- define "machine-controller.manifest-init" -}}
-  {{- $manifest := $.Values.lifecycle.jobs  -}}
-  {{- if (include "machine-controller.manifest-exist" $) }}
+  {{- $manifest := $.manifest -}}
+  {{- if (include "machine-controller.manifest-exist" $.ctx) }}
 - name: machine-manifests
-  image: {{ include "pkg.images.registry.convert" (dict "image" $manifest.image "ctx" $) }}
-  env: {{- include "pkg.common.env" $ | nindent 6 }}
-    {{- include "pkg.cluster.cp.env" $ | nindent 6 }}
-  {{- with (include "pkg.components.securityContext" (dict "sc" $manifest.securityContext "ctx" $)) }}
+  image: {{ include "pkg.images.registry.convert" (dict "image" $manifest.image "ctx" $.ctx) }}
+  imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" $manifest.image.pullPolicy "ctx" $.ctx) }}
+  env: {{- include "pkg.common.env" $.ctx | nindent 6 }}
+    {{- include "pkg.cluster.cp.env" $.ctx | nindent 6 }}
+  {{- with (include "pkg.components.securityContext" (dict "sc" $manifest.securityContext "ctx" $.ctx)) }}
   securityContext: {{ . | nindent 4 }}
   {{- end }}
   {{- with $manifest.resources }}
@@ -389,9 +337,9 @@ fi
     - /bin/sh
     - -c
     - |
-        {{- include "machine-controller.ensure-resources" $ | nindent 8 }}
-  volumeMounts: {{- include "pkg.cluster.cp.vms" $ | nindent 4 }}
-    {{- include "machine-controller.volumemounts" $ | nindent 4 }}
+        {{- include "machine-controller.ensure-resources" $.ctx | nindent 8 }}
+  volumeMounts: {{- include "pkg.cluster.cp.vms" $.ctx | nindent 4 }}
+    {{- include "machine-controller.volumemounts" $.ctx | nindent 4 }}
   {{- end }}
 {{- end -}}
 
@@ -413,7 +361,7 @@ export CA_BUNDLE=`openssl base64 -in {{ include "machine-controller.volumemounts
 # Patch the CA bundle in the webhook configurations
 kubectl patch MutatingWebhookConfiguration {{ include "machine-controller.admission.mutating-webhook-name" $ }} \
   --type='json' -p="[\
-  	{'op': 'replace', 'path': '/webhooks/0/clientConfig/caBundle', 'value': \"${CA_BUNDLE}\"  },\
+  	{'op': 'replace', 'path': '/webhooks/0/clientConfig/caBundle', 'value': \"${CA_BUNDLE}\" },\
   	{'op': 'replace', 'path': '/webhooks/1/clientConfig/caBundle', 'value': \"${CA_BUNDLE}\" } \
   ]";
   {{- end }}
diff --git a/charts/vcluster/templates/components/machine-controller/deployment.yaml b/charts/vcluster/templates/components/machine-controller/deployment.yaml
index 05f524c..e7db097 100644
--- a/charts/vcluster/templates/components/machine-controller/deployment.yaml
+++ b/charts/vcluster/templates/components/machine-controller/deployment.yaml
@@ -10,12 +10,12 @@ metadata:
   labels:
     {{- include "machine-controller.labels" $ | nindent 4 }}
     {{- with (include "pkg.components.labels" (dict "labels" $machine.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
   annotations:
     {{- include "machine-controller.manifests.checksum" $ | nindent 4 }}
     {{- with (include "pkg.components.annotations" (dict "annotations" $machine.annotations "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   {{- if not $machine.autoscaling.enabled }}
@@ -32,6 +32,8 @@ spec:
       annotations: {{- include "pkg.components.pod_annotations" (dict "annotations" $machine.podAnnotations "ctx" $) | nindent 8 }}
         {{ include "machine-controller.manifests.checksum" $ }}
         {{ include "machine-controller.webhooks.checksum" $ }}
+        checksum/kubeconfig: {{ include (print $.Template.BasePath "/components/kubernetes/kubeconfig.yaml" ) . | sha256sum }}
+        checksum/provider: {{ include (print $.Template.BasePath "/components/machine-controller/providers-secret.yaml" ) . | sha256sum }}
       labels: {{- include "machine-controller.selectorLabels" . | nindent 8 }}
         {{- include "pkg.components.pod_labels" (dict "labels" $machine.podLabels "ctx" $) | nindent 8 }}
     spec:
@@ -45,9 +47,9 @@ spec:
         {{- with $machine.imagePullSecrets }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
-      initContainers: {{- include "pkg.cluster.connectivity" $ | nindent 8 }}
+      initContainers: {{- include "pkg.cluster.connectivity" (dict "connectivity" $machine.connectivity "ctx" $) | nindent 8 }}
       {{- if $machine.component.ensureManifestsOnStartup }}
-        {{- include "machine-controller.manifest-init" $ | nindent 8 }}
+        {{- include "machine-controller.manifest-init" (dict "manifest" $machine.manifest "ctx" $) | nindent 8 }}
       {{- end }}
       containers:
           {{- with $machine.controller }}
@@ -57,12 +59,12 @@ spec:
             {{- end }}
           image: {{ include "pkg.images.registry.convert" (dict "image" .image "tag_overwrite" $machine.version "ctx" $) }}
           imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" .image.pullPolicy "ctx" $) }}
-          env: 
+          env:
           {{- if .injectProxy }}
             {{- include "pkg.common.env.w-proxy" $ | nindent 10 }}
           {{- else }}
             {{- include "pkg.common.env" $ | nindent 10 }}
-          {{- end }}          
+          {{- end }}
           {{- with .envs }}
             {{- include "pkg.utils.envs" (dict "envs" . "ctx" $) | nindent 10 }}
           {{- end }}
@@ -77,15 +79,6 @@ spec:
             {{- include "machine-controller.controller.args" $ | nindent 12 }}
             - -metrics-address=0.0.0.0:8080
             - -health-probe-address=0.0.0.0:8085
-            {{- if (include "operating-system-manager.enabled" $) }}
-            - -use-external-bootstrap
-            {{- end }}
-            {{- with (include "machine-controller.runtime" $) }}
-            - -node-container-runtime={{ . }}
-            {{- end }}
-            {{- with (include "machine-controller.pause" $) }}
-            - -node-pause-image={{ . }}
-            {{- end }}
             {{- with .args }}
               {{- include "pkg.utils.args" (dict "args" . "ctx" $) | nindent 12 }}
             {{- end }}
@@ -114,12 +107,12 @@ spec:
         - name: webhook
           image: {{ include "pkg.images.registry.convert" (dict "image" .image "tag_overwrite" $machine.version "ctx" $) }}
           imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" .image.pullPolicy "ctx" $) }}
-          env: 
+          env:
           {{- if .injectProxy }}
             {{- include "pkg.common.env.w-proxy" $ | nindent 10 }}
           {{- else }}
             {{- include "pkg.common.env" $ | nindent 10 }}
-          {{- end }}           
+          {{- end }}
           {{- with .envs }}
             {{- include "pkg.utils.envs" (dict "envs" . "ctx" $) | nindent 10 }}
           {{- end }}
@@ -162,7 +155,7 @@ spec:
               {{- end }}
             {{- end }}
           {{- end }}
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $machine.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $machine.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.affinity" (dict "affinity" $machine.affinity "ctx" $)) }}
diff --git a/charts/vcluster/templates/components/machine-controller/hpa.yaml b/charts/vcluster/templates/components/machine-controller/hpa.yaml
index 1c93e6c..a0d0a71 100644
--- a/charts/vcluster/templates/components/machine-controller/hpa.yaml
+++ b/charts/vcluster/templates/components/machine-controller/hpa.yaml
@@ -3,7 +3,7 @@
   {{- $manifest := $machine.autoscaling -}}
   {{- if $manifest.enabled }}
 ---
-apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "machine-controller.fullname" . }}
diff --git a/charts/vcluster/templates/components/machine-controller/manifests.yaml b/charts/vcluster/templates/components/machine-controller/manifests.yaml
index 24479bc..c8336fd 100644
--- a/charts/vcluster/templates/components/machine-controller/manifests.yaml
+++ b/charts/vcluster/templates/components/machine-controller/manifests.yaml
@@ -4,7 +4,7 @@
 */}}
 {{- if (include "pkg.dev.incluster" $) }}
   {{- if (include "machine-controller.enabled" $) }}
-    {{ range $path, $_ :=  .Files.Glob (include "machine-controller.manifests" $) }}
+    {{ range $path, $_ := .Files.Glob (include "machine-controller.manifests" $) }}
       {{- with $ }}
         {{- $content := (tpl (.Files.Get $path) .) -}}
         {{- if ($content | nospace) }}
@@ -23,7 +23,7 @@ metadata:
     {{- include "machine-controller.labels" . | nindent 4 }}
   namespace: {{ .Release.Namespace }}
 stringData:
-  {{ range $path, $_ :=  .Files.Glob (include "machine-controller.manifests" $) }}
+  {{ range $path, $_ := .Files.Glob (include "machine-controller.manifests" $) }}
     {{- with $ }}
       {{- $content := (tpl (.Files.Get $path) .) -}}
       {{- if ($content | nospace) }}
diff --git a/charts/vcluster/templates/components/machine-controller/pdb.yaml b/charts/vcluster/templates/components/machine-controller/pdb.yaml
index ef00035..09b3851 100644
--- a/charts/vcluster/templates/components/machine-controller/pdb.yaml
+++ b/charts/vcluster/templates/components/machine-controller/pdb.yaml
@@ -2,7 +2,7 @@
   {{- $manifest := $.Values.machine -}}
   {{- if $manifest.podDisruptionBudget -}}
 ---
-apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }}
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: {{ template "machine-controller.fullname" . }}
diff --git a/charts/vcluster/templates/components/machine-controller/webhooks.yaml b/charts/vcluster/templates/components/machine-controller/webhooks.yaml
index 52f7af0..90ca804 100644
--- a/charts/vcluster/templates/components/machine-controller/webhooks.yaml
+++ b/charts/vcluster/templates/components/machine-controller/webhooks.yaml
@@ -9,7 +9,7 @@ metadata:
   name: {{ include "machine-controller.fullname" . }}-webhooks
   labels: {{- include "machine-controller.labels" . | nindent 4 }}
 stringData:
-  {{ range $path, $_ :=  .Files.Glob (include "machine-controller.webhooks" $) }}
+  {{ range $path, $_ := .Files.Glob (include "machine-controller.webhooks" $) }}
     {{- with $ }}
       {{- base $path | nindent 4 }}: | {{- tpl (.Files.Get $path) . | nindent 6 }}
     {{ end }}
diff --git a/charts/vcluster/templates/components/operating-system-manager/_templates.tpl b/charts/vcluster/templates/components/operating-system-manager/_templates.tpl
index 3f81963..7feffe9 100644
--- a/charts/vcluster/templates/components/operating-system-manager/_templates.tpl
+++ b/charts/vcluster/templates/components/operating-system-manager/_templates.tpl
@@ -9,24 +9,24 @@ Component enabled
 {{- end }}
 
 {{/*
-Component Manifests directory
+Component Manifests Configmap/Secret name
 */}}
-{{- define "operating-system-manager.manifests.dir" -}}
-{{- printf "manifests/%s" (include "operating-system-manager.component" $) -}}
+{{- define "operating-system-manager.manifests.name" -}}
+{{- printf "%s-manifests" (include "operating-system-manager.fullname" $) -}}
 {{- end }}
 
 {{/*
 Component Manifests directory
 */}}
-{{- define "operating-system-manager.manifests" -}}
-{{- printf "%s/**.yaml" (include "operating-system-manager.manifests.dir" $) -}}
+{{- define "operating-system-manager.manifests.dir" -}}
+{{- printf "manifests/%s" (include "operating-system-manager.component" $) -}}
 {{- end }}
 
 {{/*
-Component Manifests Configmap/Secret name
+Component Manifests
 */}}
-{{- define "operating-system-manager.manifests.name" -}}
-{{- printf "%s-manifests" (include "operating-system-manager.fullname" $) -}}
+{{- define "operating-system-manager.manifests" -}}
+{{- printf "%s/**.yaml" (include "operating-system-manager.manifests.dir" $) -}}
 {{- end }}
 
 {{/*
@@ -43,7 +43,6 @@ Component Webhook
 {{- printf "%s/**.yaml" (include "operating-system-manager.webhooks.dir" $) -}}
 {{- end }}
 
-
 {{/*
   Component
 */}}
@@ -51,14 +50,6 @@ Component Webhook
 operating-system-manager
 {{- end }}
 
-
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "operating-system-manager.name" -}}
-{{- include "operating-system-manager.component" $ -}}
-{{- end }}
-
 {{/*
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
@@ -86,7 +77,6 @@ If release name contains chart name it will be used as a full name.
 {{ include "pkg.common.selectors" $ }}
 {{- end }}
 
-
 {{/*
 Create the name of the service account to use
 */}}
@@ -111,7 +101,6 @@ Create the name of the service account to use
   {{- end -}}
 {{- end -}}
 
-
 {{/*
 Create the Admission Webhook TLS Secret
 */}}
@@ -131,6 +120,72 @@ Self-Signed Admission Webhook TLS Secret
 {{ default ( printf "%s-tls" ( include "operating-system-manager.fullname" $) ) $manifest.admission.webhook.tls.name }}
 {{- end -}}
 
+{{/*
+    Manifests Checksum
+*/}}
+{{- define "operating-system-manager.manifests.checksum" -}}
+checksum/manifests: {{ (.Files.Glob (include "operating-system-manager.manifests" $) | toYaml | sha256sum | quote) }}
+{{- end }}
+
+{{/*
+    Webhook Checksum
+*/}}
+{{- define "operating-system-manager.webhooks.checksum" -}}
+checksum/webhooks: {{ (.Files.Glob (include "operating-system-manager.webhooks" $) | toYaml | sha256sum | quote) }}
+{{- end }}
+
+{{/*
+    Common Controller Arguments
+*/}}
+{{- define "operating-system-manager.controller.args" -}}
+- -kubeconfig={{ include "pkg.cluster.cp.env.mount" $ }}
+  {{- if (include "pkg.common.proxy.enabled" $) }}
+    {{- with (include "pkg.common.proxy.host" $) }}
+- -node-http-proxy={{ . }}
+      {{- with (include "pkg.common.proxy.no_proxy" $) }}
+- -node-no-proxy={{ . | quote }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  {{- if (include "pkg.images.registry.set" $) }}
+    {{- if (include "pkg.images.registry.auth" $) }}
+- -node-registry-credentials-secret={{ include "pkg.images.registry.secretnamespace" $ }}/regcreds
+    {{- end }}
+  {{- end }}
+- -cluster-dns={{ include "kubernetes.getCoreDNS" $ }}
+- -override-bootstrap-kubelet-apiserver={{ include "kubernetes.api.endpoint" $ }}
+  {{- with $.Values.osm.kubelet.featureGates }}
+- -node-kubelet-feature-gates={{ . | join "," | quote }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+    Pause Image / OSM Compatible
+*/}}
+{{- define "operating-system-manager.pause" -}}
+{{- $osm := $.Values.osm -}}
+  {{- with $osm.pause }}
+    {{- include "pkg.images.registry.convert" (dict "image" .image "ctx" $) -}}
+  {{- end }}
+{{- end }}
+
+{{/*
+    Runtime / OSM Compatible
+*/}}
+{{- define "operating-system-manager.runtime" -}}
+{{- $osm := $.Values.osm -}}
+  {{- with $osm.runtime }}
+    {{- printf "%s" . -}}
+  {{- end }}
+{{- end }}
+
+{{/*
+Create the Admission Webhook Name
+*/}}
+{{- define "operating-system-manager.admission.webhook-name" -}}
+operating-system-manager-webhook
+{{- end -}}
+
 {{/*
   Admission URL
 */}}
@@ -144,7 +199,7 @@ Self-Signed Admission Webhook TLS Secret
     {{- if (include "operating-system-manager.admission.expose.ingress" $) -}}
       {{- $base = (printf "https://%s/%s" (include "pkg.components.ingress.host" $) (include "operating-system-manager.admission.expose.ingress.context" $ | trimPrefix "/")) -}}
     {{- end -}}
-  
+
     {{/* Expose via Service (LoadBalancer) */}}
     {{- if (include "operating-system-manager.admission.expose.loadbalancer" $) -}}
       {{- $base = (printf "https://%s:%s" (include "operating-system-manager.admission.expose.loadbalancer.ip" $) (include "operating-system-manager.admission.expose.loadbalancer.port" $)) -}}
@@ -158,6 +213,7 @@ Self-Signed Admission Webhook TLS Secret
 {{- end -}}
 
 {{- define "operating-system-manager.admission.endpoint" -}}
+  {{/* Expose via Ingress */}}
   {{- if (include "operating-system-manager.admission.expose.ingress" $) -}}
     {{- printf "%s" (include "pkg.components.ingress.host" $) -}}
   {{- else if (include "operating-system-manager.admission.expose.loadbalancer" $) -}}
@@ -165,7 +221,6 @@ Self-Signed Admission Webhook TLS Secret
   {{- end -}}
 {{- end -}}
 
-
 {{/*
 Admission Expose
 */}}
@@ -182,7 +237,6 @@ Admission Expose
   {{- end -}}
 {{- end -}}
 
-
 {{- define "operating-system-manager.admission.expose.loadbalancer.ip" -}}
   {{- $manifest := $.Values.osm -}}
   {{- with $manifest.admission.service.loadBalancerIP -}}
@@ -209,28 +263,6 @@ Admission Expose
   {{- printf "%s" (required "Context Required" $manifest.admission.ingress.contextPath) -}}
 {{- end -}}
 
-
-{{/*
-    Manifests Checksum
-*/}}
-{{- define "operating-system-manager.manifests.checksum" -}}
-checksum/manifests: {{ (.Files.Glob (include "operating-system-manager.manifests" $) | toYaml | sha256sum | quote) }}
-{{- end }}
-
-{{/*
-    Manifests Checksum
-*/}}
-{{- define "operating-system-manager.webhooks.checksum" -}}
-checksum/webhooks: {{ (.Files.Glob (include "operating-system-manager.webhooks" $) | toYaml | sha256sum | quote) }}
-{{- end }}
-
-{{/*
-Create the Admission Webhook Name
-*/}}
-{{- define "operating-system-manager.admission.webhook-name" -}}
-operating-system-manager-webhook
-{{- end -}}
-
 {{/* Volumes for Admission Pod */}}
 {{- define "operating-system-manager.volumes" -}}
 - name: osm-webhooks
@@ -240,7 +272,7 @@ operating-system-manager-webhook
 - name: osm-manifests
   secret:
     defaultMode: 420
-    secretName: {{ include "operating-system-manager.manifests.name" $  }}
+    secretName: {{ include "operating-system-manager.manifests.name" $ }}
   {{- if (include "operating-system-manager.admission-enabled" $) }}
 - name: osm-webhook-certs
   secret:
@@ -260,7 +292,6 @@ operating-system-manager-webhook
   {{- include "operating-system-manager.volumemounts.certs" $ | nindent 0 }}
 {{- end -}}
 
-
 {{/* VolumeMounts for Admission Pod */}}
 {{- define "operating-system-manager.volumemounts.certs" -}}
   {{- if (include "operating-system-manager.admission-enabled" $) }}
@@ -270,28 +301,26 @@ operating-system-manager-webhook
   {{- end }}
 {{- end -}}
 
-{{/* MountPath for webhooks */}}
-{{- define "operating-system-manager.volumemounts.webhooks.path" -}}
-/tmp/osm/webhooks/
-{{- end -}}
-
-
 {{/* MountPath for certificates */}}
 {{- define "operating-system-manager.volumemounts.certs.path" -}}
 /tmp/osm/serving-certs/
 {{- end -}}
 
+{{/* MountPath for webhooks */}}
+{{- define "operating-system-manager.volumemounts.webhooks.path" -}}
+/tmp/osm/webhooks/
+{{- end -}}
+
 {{/* MountPath for Manifests */}}
 {{- define "operating-system-manager.volumemounts.manifests.path" -}}
 /tmp/osm/manifests/
 {{- end -}}
 
-
 {{/*
   Ensure All
 */}}
 {{- define "operating-system-manager.ensure-resources" -}}
-  {{- include "operating-system-manager.manifest-create" $  | nindent 0 }}
+  {{- include "operating-system-manager.manifest-create" $ | nindent 0 }}
   {{- include "operating-system-manager.admission.webhook-cert-patch" $ | nindent 0 }}
 {{- end -}}
 
@@ -302,10 +331,11 @@ operating-system-manager-webhook
   {{- if (include "operating-system-manager.manifest-exist" $) -}}
 if ! [ `find {{ include "operating-system-manager.volumemounts.manifests.path" $ }} -prune -empty 2>/dev/null` ]; then
     {{- if (include "operating-system-manager.enabled" $) }}
-  # install operating-system-manager manifests
+  # Apply operating-system-manager Manifests
   kubectl apply -f {{ include "operating-system-manager.volumemounts.manifests.path" $ }}
     {{- else }}
       {{- if $.Values.osm.component.removeManifestsOnDisable }}
+  # Delete operating-system-manager Manifests
   kubectl delete -f {{ include "operating-system-manager.volumemounts.manifests.path" $ }} 2>/dev/null || true
       {{- end }}
     {{- end }}
@@ -313,7 +343,6 @@ fi
   {{- end -}}
 {{- end -}}
 
-
 {{/*
  Validate if any Manifests are rendered
 */}}
@@ -328,13 +357,14 @@ fi
   InitContainer to apply/delete manifests
 */}}
 {{- define "operating-system-manager.manifest-init" -}}
-  {{- $manifest := $.Values.lifecycle.jobs  -}}
-  {{- if (include "operating-system-manager.manifest-exist" $) }}
+  {{- $manifest := $.manifest -}}
+  {{- if (include "operating-system-manager.manifest-exist" $.ctx) }}
 - name: osm-manifests
-  image: {{ include "pkg.images.registry.convert" (dict "image" $manifest.image "ctx" $) }}
-  env: {{- include "pkg.common.env" $ | nindent 4 }}
-    {{- include "pkg.cluster.cp.env" $ | nindent 4 }}
-  {{- with (include "pkg.components.securityContext" (dict "sc" $manifest.securityContext "ctx" $)) }}
+  image: {{ include "pkg.images.registry.convert" (dict "image" $manifest.image "ctx" $.ctx) }}
+  imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" $manifest.image.pullPolicy "ctx" $.ctx) }}
+  env: {{- include "pkg.common.env" $.ctx | nindent 4 }}
+    {{- include "pkg.cluster.cp.env" $.ctx | nindent 4 }}
+  {{- with (include "pkg.components.securityContext" (dict "sc" $manifest.securityContext "ctx" $.ctx)) }}
   securityContext: {{ . | nindent 4 }}
   {{- end }}
   {{- with $manifest.resources }}
@@ -344,19 +374,18 @@ fi
     - /bin/sh
     - -c
     - |
-        {{- include "operating-system-manager.ensure-resources" $ | nindent 8 }}
-  volumeMounts: {{- include "pkg.cluster.cp.vms" $ | nindent 4 }}
-    {{- include "operating-system-manager.volumemounts" $ | nindent 4 }}
+        {{- include "operating-system-manager.ensure-resources" $.ctx | nindent 8 }}
+  volumeMounts: {{- include "pkg.cluster.cp.vms" $.ctx | nindent 4 }}
+    {{- include "operating-system-manager.volumemounts" $.ctx | nindent 4 }}
   {{- end }}
 {{- end -}}
 
-
 {{/*
-Create the Admission Webhook TLS Secret
+  Ensure Webhooks
 */}}
 {{- define "operating-system-manager.admission.webhook-cert-patch" -}}
   {{- if not (include "operating-system-manager.admission-enabled" $) }}
-# Remove Webhooks
+# Remove Webhooks (Be explicit, since content may have changed)
 kubectl delete validatingwebhookconfiguration {{ include "operating-system-manager.admission.webhook-name" $ }} 2>/dev/null || true
 kubectl delete mutatingwebhookconfiguration {{ include "operating-system-manager.admission.webhook-name" $ }} 2>/dev/null || true
   {{- else }}
@@ -370,13 +399,12 @@ export CA_BUNDLE=`openssl base64 -in {{ include "operating-system-manager.volume
 # Patch the CA bundle in the webhook configurations
 kubectl patch ValidatingWebhookConfiguration {{ include "operating-system-manager.admission.webhook-name" $ }} \
   --type='json' -p="[\
-  	{'op': 'replace', 'path': '/webhooks/0/clientConfig/caBundle', 'value': \"${CA_BUNDLE}\"  },\
+  	{'op': 'replace', 'path': '/webhooks/0/clientConfig/caBundle', 'value': \"${CA_BUNDLE}\" },\
     {'op': 'replace', 'path': '/webhooks/1/clientConfig/caBundle', 'value': \"${CA_BUNDLE}\" } \
   ]";
 kubectl patch MutatingWebhookConfiguration {{ include "operating-system-manager.admission.webhook-name" $ }} \
   --type='json' -p="[\
-  	{'op': 'replace', 'path': '/webhooks/0/clientConfig/caBundle', 'value': \"${CA_BUNDLE}\"  }\
+  	{'op': 'replace', 'path': '/webhooks/0/clientConfig/caBundle', 'value': \"${CA_BUNDLE}\" }\
   ]";
-
   {{- end }}
 {{- end -}}
diff --git a/charts/vcluster/templates/components/operating-system-manager/admission-metrics.yaml b/charts/vcluster/templates/components/operating-system-manager/admission-metrics.yaml
deleted file mode 100644
index e69de29..0000000
diff --git a/charts/vcluster/templates/components/operating-system-manager/deployment.yaml b/charts/vcluster/templates/components/operating-system-manager/deployment.yaml
index 406b420..3d93028 100644
--- a/charts/vcluster/templates/components/operating-system-manager/deployment.yaml
+++ b/charts/vcluster/templates/components/operating-system-manager/deployment.yaml
@@ -9,12 +9,12 @@ metadata:
   labels:
     {{- include "operating-system-manager.labels" . | nindent 4 }}
     {{- with (include "pkg.components.labels" (dict "labels" $osm.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
   annotations:
     {{- include "operating-system-manager.manifests.checksum" $ | nindent 4 }}
     {{- with (include "pkg.components.annotations" (dict "annotations" $osm.annotations "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   {{- if not $osm.autoscaling.enabled }}
@@ -31,6 +31,7 @@ spec:
       annotations: {{- include "pkg.components.pod_annotations" (dict "annotations" $osm.podAnnotations "ctx" $) | nindent 8 }}
         {{ include "operating-system-manager.manifests.checksum" $ }}
         {{ include "operating-system-manager.webhooks.checksum" $ }}
+        checksum/kubeconfig: {{ include (print $.Template.BasePath "/components/kubernetes/kubeconfig.yaml" ) . | sha256sum }}
       labels: {{- include "operating-system-manager.selectorLabels" . | nindent 8 }}
         {{- include "pkg.components.pod_labels" (dict "labels" $osm.podLabels "ctx" $) | nindent 8 }}
     spec:
@@ -44,9 +45,9 @@ spec:
       securityContext: {{ . | nindent 8 }}
       {{- end }}
       terminationGracePeriodSeconds: 30
-      initContainers: {{- include "pkg.cluster.connectivity"  $ | nindent 8 }}
+      initContainers: {{- include "pkg.cluster.connectivity" (dict "connectivity" $osm.connectivity "ctx" $) | nindent 8 }}
       {{- if $osm.component.ensureManifestsOnStartup }}
-        {{- include "operating-system-manager.manifest-init" $ | nindent 8 }}
+        {{- include "operating-system-manager.manifest-init" (dict "manifest" $osm.manifest "ctx" $) | nindent 8 }}
       {{- end }}
       containers:
           {{- with $osm.controller }}
@@ -56,12 +57,12 @@ spec:
             {{- end }}
           image: {{ include "pkg.images.registry.convert" (dict "image" .image "tag_overwrite" $osm.version "ctx" $) }}
           imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" .image.pullPolicy "ctx" $) }}
-          env: 
+          env:
           {{- if .injectProxy }}
             {{- include "pkg.common.env.w-proxy" $ | nindent 10 }}
           {{- else }}
             {{- include "pkg.common.env" $ | nindent 10 }}
-          {{- end }}          
+          {{- end }}
           {{- with .envs }}
             {{- include "pkg.utils.envs" (dict "envs" . "ctx" $) | nindent 10 }}
           {{- end }}
@@ -72,13 +73,13 @@ spec:
           command:
             - /usr/local/bin/osm-controller
             - -namespace=kube-system
-            {{- include "machine-controller.controller.args" $ | nindent 12 }}
+            {{- include "operating-system-manager.controller.args" $ | nindent 12 }}
             - -metrics-address=0.0.0.0:8080
             - -health-probe-address=0.0.0.0:8085
-            {{- with (include "machine-controller.runtime" $) }}
+            {{- with (include "operating-system-manager.runtime" $) }}
             - -container-runtime={{ . }}
             {{- end }}
-            {{- with (include "machine-controller.pause" $) }}
+            {{- with (include "operating-system-manager.pause" $) }}
             - -pause-image={{ . }}
             {{- end }}
             {{- with .args }}
@@ -157,7 +158,7 @@ spec:
               {{- end }}
             {{- end }}
           {{- end }}
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $osm.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $osm.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.affinity" (dict "affinity" $osm.affinity "ctx" $)) }}
diff --git a/charts/vcluster/templates/components/operating-system-manager/hpa.yaml b/charts/vcluster/templates/components/operating-system-manager/hpa.yaml
index 69eac13..2b4a2c5 100644
--- a/charts/vcluster/templates/components/operating-system-manager/hpa.yaml
+++ b/charts/vcluster/templates/components/operating-system-manager/hpa.yaml
@@ -3,7 +3,7 @@
   {{- $manifest := $osm.autoscaling -}}
   {{- if $manifest.enabled }}
 ---
-apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "operating-system-manager.fullname" . }}
diff --git a/charts/vcluster/templates/components/operating-system-manager/manifests.yaml b/charts/vcluster/templates/components/operating-system-manager/manifests.yaml
index 1e80e75..86df7f4 100644
--- a/charts/vcluster/templates/components/operating-system-manager/manifests.yaml
+++ b/charts/vcluster/templates/components/operating-system-manager/manifests.yaml
@@ -10,7 +10,7 @@ metadata:
   labels:
     {{- include "operating-system-manager.labels" . | nindent 4 }}
 stringData:
-  {{ range $path, $_ :=  .Files.Glob (include "operating-system-manager.manifests" $) }}
+  {{ range $path, $_ := .Files.Glob (include "operating-system-manager.manifests" $) }}
     {{- with $ }}
       {{- $content := (tpl (.Files.Get $path) .) -}}
       {{- if ($content | nospace) }}
diff --git a/charts/vcluster/templates/components/operating-system-manager/pdb.yaml b/charts/vcluster/templates/components/operating-system-manager/pdb.yaml
index e1ee4f7..ed93dc1 100644
--- a/charts/vcluster/templates/components/operating-system-manager/pdb.yaml
+++ b/charts/vcluster/templates/components/operating-system-manager/pdb.yaml
@@ -2,7 +2,7 @@
   {{- $manifest := $.Values.osm -}}
   {{- if $manifest.podDisruptionBudget -}}
 ---
-apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }}
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: {{ template "operating-system-manager.fullname" . }}
diff --git a/charts/vcluster/templates/components/operating-system-manager/webhooks.yaml b/charts/vcluster/templates/components/operating-system-manager/webhooks.yaml
index 11dd471..5458dd3 100644
--- a/charts/vcluster/templates/components/operating-system-manager/webhooks.yaml
+++ b/charts/vcluster/templates/components/operating-system-manager/webhooks.yaml
@@ -9,7 +9,7 @@ metadata:
   name: {{ include "operating-system-manager.fullname" . }}-webhooks
   labels: {{- include "operating-system-manager.labels" . | nindent 4 }}
 stringData:
-  {{ range $path, $_ :=  .Files.Glob (include "operating-system-manager.webhooks" $) }}
+  {{ range $path, $_ := .Files.Glob (include "operating-system-manager.webhooks" $) }}
     {{- with $ }}
       {{- base $path | nindent 4 }}: | {{- tpl (.Files.Get $path) . | nindent 6 }}
     {{ end }}
diff --git a/charts/vcluster/templates/expose/issuer.yaml b/charts/vcluster/templates/expose/issuer.yaml
index 2fcf291..8d9a38b 100644
--- a/charts/vcluster/templates/expose/issuer.yaml
+++ b/charts/vcluster/templates/expose/issuer.yaml
@@ -6,7 +6,7 @@ metadata:
   name:  {{ include "pkg.components.certificates.default_issuer" $ }}
   namespace: {{ .Release.Namespace }}
   labels:
-    {{- include "vcluster.labels" $  | nindent 4 }}
+    {{- include "vcluster.labels" $ | nindent 4 }}
 spec:
   selfSigned: {}
 {{- end }}
diff --git a/charts/vcluster/templates/extra-manifests.yaml b/charts/vcluster/templates/extra-manifests.yaml
index 278bfe4..caf2910 100644
--- a/charts/vcluster/templates/extra-manifests.yaml
+++ b/charts/vcluster/templates/extra-manifests.yaml
@@ -8,7 +8,7 @@ items:
   {{- if $.Release.IsInstall }}
     {{- with $.Values.lifecycle.current.extraManifestsOnInstall }}
       {{- range $file, $content := . }}
-    - {{- include "pkg.utils.template" (dict "tpl" $content "ctx" $) | nindent 4 }}
+  - {{- include "pkg.utils.template" (dict "tpl" $content "ctx" $) | nindent 4 }}
       {{- end }}
     {{- end }}
   {{- end }}
diff --git a/charts/vcluster/templates/lifecycle/cronjob.yaml b/charts/vcluster/templates/lifecycle/cronjob.yaml
index d61d96a..20dd1d2 100644
--- a/charts/vcluster/templates/lifecycle/cronjob.yaml
+++ b/charts/vcluster/templates/lifecycle/cronjob.yaml
@@ -9,9 +9,9 @@ metadata:
     {{- with (include "pkg.components.labels" (dict "labels" $manifest.labels "ctx" $)) }}
       {{- . | nindent 4 }}
     {{- end }}
-  annotations:  
+  annotations:
     {{- with (include "pkg.components.annotations" (dict "annotations" $manifest.annotations "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   schedule: "{{ $manifest.schedule }}"
@@ -24,7 +24,7 @@ spec:
           {{- toYaml . | nindent 8 }}
         {{- end }}
       annotations:
-        checksum/scripts: {{ .Files.Get "/templates/scripts-configmap.yaml" | sha256sum  }}
+        checksum/scripts: {{ .Files.Get "/templates/scripts-configmap.yaml" | sha256sum }}
         {{- with $manifest.annotations }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -32,4 +32,3 @@ spec:
       template:
       {{- (include (print $.Template.BasePath "/lifecycle/setup.yaml") . | fromYaml ).spec.template | toYaml | nindent 8 }}
 {{- end -}}
-
diff --git a/charts/vcluster/templates/lifecycle/extra-manifests.yaml b/charts/vcluster/templates/lifecycle/extra-manifests.yaml
index 7abddc4..69740f5 100644
--- a/charts/vcluster/templates/lifecycle/extra-manifests.yaml
+++ b/charts/vcluster/templates/lifecycle/extra-manifests.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "vcluster.fullname" .  }}-manifests
+  name: {{ include "vcluster.fullname" . }}-manifests
   labels:
     {{- include "vcluster.labels" $ | nindent 4 }}
 type: Opaque
diff --git a/charts/vcluster/templates/lifecycle/rbac.yaml b/charts/vcluster/templates/lifecycle/rbac.yaml
index 1de9457..6800819 100644
--- a/charts/vcluster/templates/lifecycle/rbac.yaml
+++ b/charts/vcluster/templates/lifecycle/rbac.yaml
@@ -5,10 +5,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 # You need to already have a Role named "pod-reader" in that namespace.
 kind: RoleBinding
 metadata:
-  name: {{ include "vcluster.fullname" .  }}-installer
+  name: {{ include "vcluster.fullname" . }}-installer
 subjects:
 - kind: ServiceAccount
-  name: {{ include "vcluster.serviceAccountName"  . }}
+  name: {{ include "vcluster.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 roleRef:
   # "roleRef" specifies the binding to a Role / ClusterRole
@@ -21,7 +21,7 @@ roleRef:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ include "vcluster.fullname" .  }}
+  name: {{ include "vcluster.fullname" . }}
   labels: {{- include "vcluster.labels" . | nindent 4 }}
   namespace: {{ .Release.Namespace }}
 rules:
@@ -40,38 +40,38 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ include "vcluster.fullname" .  }}
+  name: {{ include "vcluster.fullname" . }}
   labels: {{- include "vcluster.labels" . | nindent 4 }}
   namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: {{ include "vcluster.fullname" .  }}
+  name: {{ include "vcluster.fullname" . }}
 subjects:
 - kind: ServiceAccount
-  name: {{ include "vcluster.serviceAccountName"  . }}
+  name: {{ include "vcluster.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
-{{- if $.Values.lifecycle.argocd.rbac }}  
+{{- if $.Values.lifecycle.argocd.rbac }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ include "vcluster.fullname" .  }}
-  labels: {{- include "vcluster.labels" . | nindent 4 }}  
+  name: {{ include "vcluster.fullname" . }}
+  labels: {{- include "vcluster.labels" . | nindent 4 }}
   namespace: {{ $.Values.lifecycle.argocd.namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: {{ include "vcluster.fullname" .  }}
+  name: {{ include "vcluster.fullname" . }}
 subjects:
 - kind: ServiceAccount
-  name: {{ include "vcluster.serviceAccountName"  . }}
+  name: {{ include "vcluster.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ include "vcluster.fullname" .  }}
+  name: {{ include "vcluster.fullname" . }}
   labels: {{- include "vcluster.labels" . | nindent 4 }}
   namespace: {{ $.Values.lifecycle.argocd.namespace }}
 rules:
@@ -86,4 +86,4 @@ rules:
   - create
   - update
   - delete
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/charts/vcluster/templates/lifecycle/scripts.yaml b/charts/vcluster/templates/lifecycle/scripts.yaml
index a474d7c..d778340 100644
--- a/charts/vcluster/templates/lifecycle/scripts.yaml
+++ b/charts/vcluster/templates/lifecycle/scripts.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "vcluster.fullname" .  }}-lifecycle-scripts
+  name: {{ include "vcluster.fullname" . }}-lifecycle-scripts
   labels: {{- include "vcluster.labels" $ | nindent 4 }}
 data:
   configure-vcluster.sh: |-
diff --git a/charts/vcluster/templates/lifecycle/setup.yaml b/charts/vcluster/templates/lifecycle/setup.yaml
index 9cb2c6f..8fd6a34 100644
--- a/charts/vcluster/templates/lifecycle/setup.yaml
+++ b/charts/vcluster/templates/lifecycle/setup.yaml
@@ -8,12 +8,12 @@ metadata:
   name: {{ include "vcluster.fullname" $ }}-setup
   labels: {{- include "vcluster.labels" $ | nindent 4 }}
     {{- with (include "pkg.components.labels" (dict "labels" $jobs.setup.labels "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
   annotations:
-    checksum/config: {{ .Files.Get (printf "templates/bootstrap/kubeadm-config.yaml") | sha256sum  }}
+    checksum/config: {{ .Files.Get (printf "templates/bootstrap/kubeadm-config.yaml") | sha256sum }}
     {{- with (include "pkg.components.annotations" (dict "annotations" $jobs.setup.annotations "ctx" $)) }}
-      {{-  . | nindent 4 }}
+      {{- . | nindent 4 }}
     {{- end }}
 spec:
   {{- with $jobs.setup.ttlSecondsAfterFinished }}
@@ -21,12 +21,12 @@ spec:
   {{- end }}
   template:
     metadata:
-      labels: {{- include "kubernetes.labels" $ | nindent 8 }}
+      labels: {{- include "kubernetes.selectorLabels" $ | nindent 8 }}
         {{- include "pkg.components.pod_labels" (dict "labels" $manifest.podLabels "ctx" $) | nindent 8 }}
       annotations:
         {{- include "pkg.components.pod_annotations" (dict "annotations" $manifest.podAnnotations "ctx" $) | nindent 8 }}
     spec:
-      {{- with (include "pkg.components.nodeselector" (dict "nodeselector" $manifest.nodeSelector "ctx" $)) }}
+      {{- with (include "pkg.components.nodeselector" (dict "nodeSelector" $manifest.nodeSelector "ctx" $)) }}
       nodeSelector: {{- . | nindent 8 }}
       {{- end }}
       {{- with (include "pkg.components.tolerations" (dict "tolerations" $manifest.tolerations "ctx" $)) }}
@@ -52,11 +52,11 @@ spec:
       # Reconciler Operates in the current Cluster, therefore automounting the ServiceAccountToken is required
       automountServiceAccountToken: true
       restartPolicy: OnFailure
-      initContainers: {{- include "pkg.cluster.connectivity" $ | nindent 8 }}
+      initContainers: {{- include "pkg.cluster.connectivity" (dict "connectivity" $manifest.connectivity "ctx" $) | nindent 8 }}
       containers:
       - name: current
         image: {{ include "pkg.images.registry.convert" (dict "image" $manifest.image "ctx" $) }}
-        imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" $manifest.image.pullPolicy  "ctx" $) }}
+        imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" $manifest.image.pullPolicy "ctx" $) }}
         command: [ '/bin/bash', '/scripts/configure-current.sh' ]
         env:
         {{- if $jobs.setup.injectProxy }}
@@ -80,14 +80,14 @@ spec:
           name: cache-current
       - name: vcluster
         image: {{ include "pkg.images.registry.convert" (dict "image" $manifest.image "ctx" $) }}
-        imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" $manifest.image.pullPolicy  "ctx" $) }}
+        imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" $manifest.image.pullPolicy "ctx" $) }}
         command: [ '/bin/bash', '/scripts/configure-vcluster.sh' ]
         env:
         {{- if $jobs.setup.injectProxy }}
           {{- include "pkg.common.env.w-proxy" $ | nindent 8 }}
         {{- else }}
           {{- include "pkg.common.env" $ | nindent 8 }}
-        {{- end }}        
+        {{- end }}
         {{- include "pkg.utils.xdg-env" $ | nindent 8 }}
         - name: KUBECONFIG
           value: "/etc/kubernetes/admin.conf"
@@ -130,21 +130,21 @@ spec:
           defaultMode: 0777
       - name: config
         configMap:
-          name: "{{ include "kubernetes.fullname" $  }}-kubeadm-config"
+          name: "{{ include "kubernetes.fullname" $ }}-kubeadm-config"
       - name: manifests
         projected:
           sources:
           - secret:
-              name: {{ include "vcluster.fullname" .  }}-manifests
+              name: {{ include "vcluster.fullname" . }}-manifests
       {{- if $kubernetes.konnectivity.enabled }}
         {{- if or $kubernetes.konnectivity.server.enabled $kubernetes.konnectivity.agent.enabled }}
           - configMap:
-              name: "{{ include "kubernetes.fullname" $  }}-konnectivity-manifests"
+              name: "{{ include "kubernetes.fullname" $ }}-konnectivity-manifests"
         {{- end }}
       {{- end }}
       {{- if $kubernetes.coredns.enabled }}
           - configMap:
-              name: "{{ include "kubernetes.fullname" $  }}-coredns-manifests"
+              name: "{{ include "kubernetes.fullname" $ }}-coredns-manifests"
       {{- end }}
       {{- with $manifest.extraVolumes }}
         {{- toYaml . | nindent 6 }}
diff --git a/charts/vcluster/templates/pkg/_cluster.tpl b/charts/vcluster/templates/pkg/_cluster.tpl
index 7292e4b..19fff9e 100644
--- a/charts/vcluster/templates/pkg/_cluster.tpl
+++ b/charts/vcluster/templates/pkg/_cluster.tpl
@@ -79,13 +79,13 @@ https://kubernetes.default.svc
     Connectivity Container
 */}}
 {{- define "pkg.cluster.connectivity" -}}
-  {{- $manifest := $.Values.lifecycle.jobs  -}}
+  {{- $manifest := $.connectivity -}}
 - name: connectivity
-  image: {{ include "pkg.images.registry.convert" (dict "image" $manifest.image "ctx" $) }}
-  imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" $manifest.image.pullPolicy "ctx" $) }}
-  env:  {{- include "pkg.common.env" $ | nindent 4 }}
-  {{- include "pkg.cluster.cp.env" $ | nindent 4 }}
-  {{- with (include "pkg.components.securityContext" (dict "sc" $manifest.securityContext "ctx" $)) }}
+  image: {{ include "pkg.images.registry.convert" (dict "image" $manifest.image "ctx" $.ctx) }}
+  imagePullPolicy: {{ include "pkg.images.registry.pullpolicy" (dict "policy" $manifest.image.pullPolicy "ctx" $.ctx) }}
+  env: {{- include "pkg.common.env" $.ctx | nindent 4 }}
+  {{- include "pkg.cluster.cp.env" $.ctx | nindent 4 }}
+  {{- with (include "pkg.components.securityContext" (dict "sc" $manifest.securityContext "ctx" $.ctx)) }}
   securityContext: {{ . | nindent 4 }}
   {{- end }}
   {{- with $manifest.resources }}
@@ -100,5 +100,5 @@ https://kubernetes.default.svc
         until kubectl cluster-info >/dev/null 2>/dev/null; do
           sleep 3
         done
-  volumeMounts: {{- include "pkg.cluster.cp.vms" $ | nindent 4 }}
+  volumeMounts: {{- include "pkg.cluster.cp.vms" $.ctx | nindent 4 }}
 {{- end }}
diff --git a/charts/vcluster/templates/pkg/_common.tpl b/charts/vcluster/templates/pkg/_common.tpl
index fc68e40..fe0e620 100644
--- a/charts/vcluster/templates/pkg/_common.tpl
+++ b/charts/vcluster/templates/pkg/_common.tpl
@@ -96,7 +96,7 @@ Common Selector Labels
     {{- $no_proxy = ($no_proxy | trimSuffix ",") -}}
 
     {{/* Standard Stuff */}}
-    {{- $no_proxy = printf "%s,%s,.%s" $no_proxy "localhost,127.0.0.1,.svc,svc.,$KUBERNETES_SERVICE_HOST" ($.Release.Namespace | trimAll ".") -}}
+    {{- $no_proxy = printf "%s,%s,.%s" $no_proxy "localhost,127.0.0.1,.svc,svc." ($.Release.Namespace | trimAll ".") -}}
 
     {{/* Kubernetes Component */}}
     {{- if (include "kubernetes.enabled" $) -}}
@@ -143,11 +143,11 @@ Common Selector Labels
 {{- define "pkg.common.proxy.env" -}}
   {{- if (include "pkg.common.proxy.enabled" $) -}}
     {{- with (include "pkg.common.proxy.host" $) }}
-- name: "HTTP_RROXY"
+- name: "HTTP_PROXY"
   value: {{ . | quote }}
 - name: "http_proxy"
   value: {{ . | quote }}
-- name: "HTTPS_RROXY"
+- name: "HTTPS_PROXY"
   value: {{ . | quote }}
 - name: "https_proxy"
   value: {{ . | quote }}
diff --git a/charts/vcluster/templates/pkg/_images.tpl b/charts/vcluster/templates/pkg/_images.tpl
index 257c684..e6fdad2 100644
--- a/charts/vcluster/templates/pkg/_images.tpl
+++ b/charts/vcluster/templates/pkg/_images.tpl
@@ -3,7 +3,7 @@
 */}}
 {{- define "pkg.images.registry.url" -}}
   {{- if (include "pkg.images.registry.set" $) -}}
-    {{- $url := $.Values.global.registry.endpoint -}}
+    {{- $url := $.Values.global.registries.primary.endpoint -}}
     {{- printf "%s" ($url | trimAll "/") -}}
   {{- end -}}
 {{- end -}}
@@ -12,7 +12,7 @@
     Docker Registry Set
 */}}
 {{- define "pkg.images.registry.set" -}}
-{{- $url := $.Values.global.registry.endpoint -}}
+{{- $url := $.Values.global.registries.primary.endpoint -}}
   {{- if $url -}}
     {{- true -}}
   {{- end -}}
@@ -22,8 +22,8 @@
     Docker Credentials Set
 */}}
 {{- define "pkg.images.registry.auth" -}}
-{{- $registry := $.Values.global.registry -}}
-  {{- if and ($registry.creds.username) ($registry.creds.password) -}}
+{{- $registry := $.Values.global.registries -}}
+  {{- if and ($registry.primary.creds.username) ($registry.primary.creds.password) -}}
     {{- true -}}
   {{- end -}}
 {{- end -}}
@@ -47,10 +47,25 @@ kube-system
     Docker Credentials (DockerConfigJSON)
 */}}
 {{- define "pkg.images.dockerconfigjson" -}}
+  {{- $auths := list }}
+
   {{- if and (include "pkg.images.registry.set" $) (include "pkg.images.registry.auth" $) -}}
-    {{- $registry := $.Values.global.registry -}}
-    {{- printf "{\"auths\":{\"%s\":{\"auth\":\"%s\"}}}" (include "pkg.images.registry.url" $) (printf "%s:%s" $registry.creds.username $registry.creds.password | b64enc) | b64enc }}
-  {{- end -}}
+    {{- $registry := $.Values.global.registries.primary -}}
+    {{- $url := include "pkg.images.registry.url" $ }}
+    {{- $auth := printf "\"%s\":{\"auth\":\"%s\"}" $url (printf "%s:%s" $registry.creds.username $registry.creds.password | b64enc) }}
+    {{- $auths = append $auths $auth }}
+  {{- end }}
+
+  {{- range $url, $cfg := $.Values.global.registries.secondaries }}
+    {{- if and $cfg.creds.username $cfg.creds.password }}
+      {{- $auth := printf "\"%s\":{\"auth\":\"%s\"}" $url (printf "%s:%s" $cfg.creds.username $cfg.creds.password | b64enc) }}
+      {{- $auths = append $auths $auth }}
+    {{- end }}
+  {{- end }}
+
+  {{- if $auths }}
+    {{- printf "{\"auths\":{%s}}" (join "," $auths) | b64enc }}
+  {{- end }}
 {{- end -}}
 
 {{/* PullSecret for Registry */}}
@@ -59,12 +74,11 @@ kube-system
   {{- if (include "pkg.images.registry.auth" $) }}
 - name: {{ template "pkg.images.registry.secretname" $ }}
   {{- end }}
-  {{- if $components.workloads.image.pullsecrets }}
-     {{- toYaml $components.workloads.image.pullsecrets | nindent 0 }}
+  {{- if $components.workloads.image.pullSecrets }}
+    {{- toYaml $components.workloads.image.pullSecrets | nindent 0 }}
   {{- end }}
 {{- end -}}
 
-
 {{/* PullPolicy */}}
 {{- define "pkg.images.registry.pullpolicy" -}}
   {{- $components := $.ctx.Values.global.components -}}
@@ -77,7 +91,6 @@ kube-system
   {{- end -}}
 {{- end -}}
 
-
 {{/*
     Prepend Registry URL to Image
 
diff --git a/charts/vcluster/templates/pkg/_substitution.tpl b/charts/vcluster/templates/pkg/_substitution.tpl
index e751cac..a4f1c95 100644
--- a/charts/vcluster/templates/pkg/_substitution.tpl
+++ b/charts/vcluster/templates/pkg/_substitution.tpl
@@ -1,7 +1,7 @@
 {{- define "pkg.substition.variables" -}}
 
   {{/* Custom Properties */}}
-  {{- include  "pkg.substition.properties" $ | nindent 0 }}
+  {{- include "pkg.substition.properties" $ | nindent 0 }}
 
   {{/* Common Variables */}}
 cluster_name: {{ include "pkg.cluster.name" $ }}
diff --git a/charts/vcluster/templates/pkg/_utils.tpl b/charts/vcluster/templates/pkg/_utils.tpl
index 98020c8..53c0b4f 100644
--- a/charts/vcluster/templates/pkg/_utils.tpl
+++ b/charts/vcluster/templates/pkg/_utils.tpl
@@ -50,7 +50,7 @@
 {{- define "pkg.utils.template" -}}
   {{- if $.ctx }}
     {{- if typeIs "string" $.tpl }}
-      {{- tpl  $.tpl $.ctx  | replace "+|" "\n" }}
+      {{- tpl $.tpl $.ctx | replace "+|" "\n" }}
     {{- else }}
       {{- tpl ($.tpl | toYaml) $.ctx | replace "+|" "\n" }}
     {{- end }}
@@ -61,7 +61,7 @@
 {{- define "pkg.utils.envs" -}}
   {{- range $key, $value := $.envs }}
 - name: {{ $key }}
-  value: {{ include "pkg.utils.template" (dict "tpl" $value "ctx" $.ctx) }} 
+  value: {{ include "pkg.utils.template" (dict "tpl" $value "ctx" $.ctx) }}
   {{- end }}
 {{- end -}}
 
@@ -79,4 +79,4 @@
 
 {{- define "pkg.utils.kubeVersion" -}}
 {{- default .Capabilities.KubeVersion.Version .Values.utils.kubeVersion -}}
-{{- end -}}
\ No newline at end of file
+{{- end -}}
diff --git a/charts/vcluster/templates/serviceaccount.yaml b/charts/vcluster/templates/serviceaccount.yaml
index adfcb74..6d3b5d8 100644
--- a/charts/vcluster/templates/serviceaccount.yaml
+++ b/charts/vcluster/templates/serviceaccount.yaml
@@ -4,7 +4,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "vcluster.serviceAccountName"  . }}
+  name: {{ include "vcluster.serviceAccountName" . }}
   labels:
     {{- include "vcluster.labels" . | nindent 4 }}
   {{- with $manifest.serviceAccount.annotations }}
diff --git a/charts/vcluster/values.yaml b/charts/vcluster/values.yaml
index 7fd0d91..e0a098b 100644
--- a/charts/vcluster/values.yaml
+++ b/charts/vcluster/values.yaml
@@ -6,15 +6,24 @@ global:
     # -- No Proxy Hosts
     no_proxy: "10.0.0.0/8"
 
-  # Docker Registry
-  registry:
-    # -- Registry Endpoint
-    endpoint: ""
-    creds:
-      # -- Registry Username
-      username: ""
-      # -- Registry Password
-      password: ""
+  # Image Registries
+  registries:
+    # -- Default Registry (used for kubeadm, regcred secret etc.)
+    primary:
+      # -- Registry Endpoint
+      endpoint: ""
+      creds:
+        # -- Registry Username
+        username: ""
+        # -- Registry Password
+        password: ""
+    # -- Additional Registries (used in regcred secret)
+    secondaries: {}
+      # -- Key: registry url
+      # docker.io:
+      #   creds:
+      #     username: ""
+      #     password: ""
 
   # -- StorageClassName for all persistent volumes
   storageClassName: ""
@@ -180,6 +189,11 @@ lifecycle:
     version: 1.9.18
     # -- Install only on chart install (First install)
     on_install: true
+    # -- Enable BGP Control Plane feature
+    bgpControlPlane:
+      enabled: true
+    # -- Specify which network interfaces can run the eBPF datapath
+    devices: ""
 
   # Create Additional Kubeconfigs which you can directly use to access the cluster in your existing toolchain (See values.yaml)
   # @default -- See values.yaml
@@ -207,15 +221,6 @@ lifecycle:
 
   # Additional customization for interactions with the current cluster
   current:
-
-    # -- Additional configuration script for the current cluster (supports templating)
-    setupScript:
-    #  echo "I am a script which runs on the current cluster"
-
-    # -- Additional configuration script for the vcluster during cleanup (supports templating)
-    cleanupScript:
-    #  echo "I am a script which runs on the current cluster"
-
     # -- These manifests will be applied inside the cluster (supports templating)
     # @default -- See values.yaml
     extraManifests: {}
@@ -238,34 +243,11 @@ lifecycle:
 
   # Additional customization for interactions with the vcluster cluster
   vcluster:
+    # -- List of URLs which will be applied inside the vcluster (supports templating)
+    extraOnlineManifests: []
 
-    # -- Additional configuration script for the vcluster during reconciler (supports templating)
-    setupScript:
-    #  echo "I am a script which runs on the vcluster"
-
-    # -- Additional configuration script for the vcluster during cleanup (supports templating)
-    cleanupScript:
-    #  echo "I am a script which runs on the vcluster"
-
-    # -- These manifests will be applied inside the vcluster (supports templating)
-    # @default -- See values.yaml
-    extraManifests: {}
-    # -- Filename of the manifest
-    # namespace.yaml:
-    #   apiVersion: v1
-    #   kind: Namespace
-    #   metadata:
-    #     name: example
-
-    # -- These manifests will be applied inside the vcluster, but only on $.Release.Install and wont be touched again (supports templating)
-    # @default -- See values.yaml
-    extraManifestsOnInstall: {}
-    # -- Filename of the manifest
-    # namespace.yaml:
-    #   apiVersion: v1
-    #   kind: Namespace
-    #   metadata:
-    #     name: example
+    # -- List of URLs which will be applied inside the vcluster, but only on $.Release.Install and wont be touched again (supports templating)
+    extraOnlineManifestsOnInstall: []
 
   # ArgoCD Lifecycle configuration
   argocd:
@@ -279,7 +261,7 @@ lifecycle:
     image:
       registry: registry-group.mgmtbi.ch
       repository: sre/gitops/cluster_bootstrap
-      pullPolicy: Always
+      pullPolicy: IfNotPresent
       # Overrides the image tag whose default is the chart appVersion.
       tag: "dev.clusterbuild"
       digest: ""
@@ -333,6 +315,35 @@ lifecycle:
     #   cpu: 100m
     #   memory: 128Mi
 
+    # Connectivity
+    connectivity:
+      # Image Configuration
+      image:
+        # -- Image registry
+        registry: ghcr.io
+        # -- Image repository
+        repository: kvaps/kubernetes-tools
+        # -- Image pull policy
+        pullPolicy: IfNotPresent
+        # -- Image tag
+        tag: "v0.13.4"
+        # -- Image Digest
+        digest: ""
+        # -- Image pull Secrets
+        pullSecrets: []
+      # -- Container Security Context
+      securityContext:
+        enabled: true
+        allowPrivilegeEscalation: false
+        privileged: false
+        runAsUser: 20000
+        runAsGroup: 20000
+        capabilities:
+          drop:
+          - ALL
+      # -- Resources configuration
+      resources: {}
+
   # Setup Job
   # Uses the workload settings from the jobs section above
   setup:
@@ -397,33 +408,12 @@ machine:
   # -- Tag Version used for machine-controller components
   version: "v1.57.0"
 
-  # Kubelect Configuration
-  kubelet:
-    # -- FeatureGates for kubelet
-    featureGates: []
-    # RotateKubeletServerCertificate=true
-
-  # -- Used Runtime
-  runtime: containerd
-
-  # Pause Image (Required on each machine)
-  pause:
-    image:
-      # -- Image registry
-      registry: ""
-      # -- Image repository
-      repository: pause
-      # -- Image pull policy
-      pullPolicy: IfNotPresent
-      # -- Image tag
-      tag: "3.5"
-      # -- Image Digest
-      digest: ""
-
   # Controller Component
   controller:
     # -- Controller Command Arguments ([See Available](https://github.com/kubermatic/machine-controller/blob/main/cmd/machine-controller/main.go))
     args:
+      log-debug: false
+      log-format: json # json or console
       node-csr-approver: true
       join-cluster-timeout: 25m
       worker-count: 10
@@ -503,15 +493,16 @@ machine:
       tls:
         # -- Additional DNS Names for ADmission certificate
         dnsNames: []
-        # -- Additional IP adresses for Admission certificate
+        # -- Additional IP addresses for Admission certificate
         ipAddresses: []
         # -- Override the TLS Secret Name
         name: ""
 
     # -- Webhook Command Arguments ([See Available](https://github.com/kubermatic/machine-controller/blob/main/cmd/webhook/main.go))
     args:
-      v: 4
-      # kubernetes-version-constraints: ">=1.18.0"
+      # on debug level, full Machine objects with inline credentials might be logged, beware!
+      log-debug: false
+      log-format: json # json or console
 
     image:
       # -- Image registry
@@ -698,13 +689,71 @@ machine:
     # If not set and create is true, a name is generated using the fullname template
     name: ""
 
+  # Connectivity
+  connectivity:
+    # Image Configuration
+    image:
+      # -- Image registry
+      registry: ghcr.io
+      # -- Image repository
+      repository: kvaps/kubernetes-tools
+      # -- Image pull policy
+      pullPolicy: IfNotPresent
+      # -- Image tag
+      tag: "v0.13.4"
+      # -- Image Digest
+      digest: ""
+      # -- Image pull Secrets
+      pullSecrets: []
+    # -- Container Security Context
+    securityContext:
+      enabled: true
+      allowPrivilegeEscalation: false
+      privileged: false
+      runAsUser: 20000
+      runAsGroup: 20000
+      capabilities:
+        drop:
+        - ALL
+    # -- Resources configuration
+    resources: {}
+
+  # Manifest
+  manifest:
+    # Image Configuration
+    image:
+      # -- Image registry
+      registry: ghcr.io
+      # -- Image repository
+      repository: kvaps/kubernetes-tools
+      # -- Image pull policy
+      pullPolicy: IfNotPresent
+      # -- Image tag
+      tag: "v0.13.4"
+      # -- Image Digest
+      digest: ""
+      # -- Image pull Secrets
+      pullSecrets: []
+    # -- Container Security Context
+    securityContext:
+      enabled: true
+      allowPrivilegeEscalation: false
+      privileged: false
+      runAsUser: 20000
+      runAsGroup: 20000
+      capabilities:
+        drop:
+        - ALL
+    # -- Resources configuration
+    resources: {}
+
 # ----------------------------
 #  Operating System Manager
 # ----------------------------
-# Refernece:
+# Reference:
 osm:
   # -- Enable Operating System Manager Component
-  enabled: false
+  enabled: true
 
   # Component Settings
   component:
@@ -718,12 +767,37 @@ osm:
   # -- Tag Version used for both components
   version: "v1.3.0"
 
+  # Kubelet Configuration
+  kubelet:
+    # -- FeatureGates for kubelet
+    featureGates: []
+    # RotateKubeletServerCertificate=true
+
+  # -- Used Runtime
+  runtime: containerd
+
+  # Pause Image (Required on each machine)
+  pause:
+    image:
+      # -- Image registry
+      registry: ""
+      # -- Image repository
+      repository: pause
+      # -- Image pull policy
+      pullPolicy: IfNotPresent
+      # -- Image tag
+      tag: "3.5"
+      # -- Image Digest
+      digest: ""
+
   # Controller Component
   controller:
 
     # -- Controller Command Arguments ([See Available](https://github.com/kubermatic/operating-system-manager/blob/main/cmd/osm-controller/main.go))
     args:
       worker-count: 10
+      log-debug: false
+      log-format: json # json or console
 
     image:
       # -- Image registry
@@ -790,7 +864,7 @@ osm:
   # The Admission Webhooks are deployed into the new cluster (Testing)
   admission:
     # -- Enable Admission Webhook
-    enabled: true
+    enabled: false
 
     # Admission Webhook Config
     webhook:
@@ -799,14 +873,15 @@ osm:
       tls:
         # -- Additional DNS Names for ADmission certificate
         dnsNames: []
-        # -- Additional IP adresses for Admission certificate
+        # -- Additional IP addresses for Admission certificate
         ipAddresses: []
         # -- Override the TLS Secret Name
         name: ""
 
     # -- Webhook Command Arguments ([See Available](https://github.com/kubermatic/operating-system-manager/blob/main/cmd/webhook/main.go))
     args:
-      v: 4
+      log-debug: false
+      log-format: json # json or console
 
     image:
       # -- Image registry
@@ -975,7 +1050,7 @@ osm:
         # -- Set relabelings for the endpoint of the serviceMonitor
         relabelings: []
 
-  # SericeAccount
+  # ServiceAccount
   serviceAccount:
     # -- Specifies whether a service account should be created
     create: true
@@ -998,6 +1073,63 @@ osm:
     # -- Benchmark Memory Usage
     targetMemoryUtilizationPercentage:
 
+  # Connectivity
+  connectivity:
+    # Image Configuration
+    image:
+      # -- Image registry
+      registry: ghcr.io
+      # -- Image repository
+      repository: kvaps/kubernetes-tools
+      # -- Image pull policy
+      pullPolicy: IfNotPresent
+      # -- Image tag
+      tag: "v0.13.4"
+      # -- Image Digest
+      digest: ""
+      # -- Image pull Secrets
+      pullSecrets: []
+    # -- Container Security Context
+    securityContext:
+      enabled: true
+      allowPrivilegeEscalation: false
+      privileged: false
+      runAsUser: 20000
+      runAsGroup: 20000
+      capabilities:
+        drop:
+        - ALL
+    # -- Resources configuration
+    resources: {}
+
+  # Manifest
+  manifest:
+    # Image Configuration
+    image:
+      # -- Image registry
+      registry: ghcr.io
+      # -- Image repository
+      repository: kvaps/kubernetes-tools
+      # -- Image pull policy
+      pullPolicy: IfNotPresent
+      # -- Image tag
+      tag: "v0.13.5"
+      # -- Image Digest
+      digest: ""
+      # -- Image pull Secrets
+      pullSecrets: []
+    # -- Container Security Context
+    securityContext:
+      enabled: true
+      allowPrivilegeEscalation: false
+      privileged: false
+      runAsUser: 20000
+      runAsGroup: 20000
+      capabilities:
+        drop:
+        - ALL
+    # -- Resources configuration
+    resources: {}
 
 # ----------------------------
 #  Kubernetes Component
@@ -1006,16 +1138,10 @@ kubernetes:
   # -- Enable Kubernetes Component
   enabled: true
 
-  # Component Settings
-  component:
-
-    # -- Remove all manifests on disable in the vcluster (**Attention**: When crds are deleted all crs will be deleted as well)
-    removeManifestsOnDisable: true
-
   # -- Version for API Server, Scheduler, Controller Manager (Tag for all kubernetes components)
   version: "v1.25.0"
 
-  # -- ControlerPlaneEndpoint
+  # -- ControllerPlaneEndpoint
   controlPlane:
     # -- Endpoint for ControlPlane (eg `128.1314.1234.4242:6443`). If not set, the vcluster will try to find the endpoint automatically.
     endpoint:
@@ -1036,14 +1162,13 @@ kubernetes:
     enabled: true
 
     certSANs:
-      # -- Additonal DNS names for ETCD ceritifcate
+      # -- Additional DNS names for ETCD certificate
       dnsNames: []
-      # -- Additonal IP adresses names for ETCD ceritifcate
+      # -- Additional IP addresses names for ETCD certificate
       ipAddresses: []
 
     # -- Extra arguments for ETCD
-    args:
-      snapshot-count: 10000
+    args: {}
 
     # https://console.cloud.google.com/gcr/images/etcd-development/GLOBAL/etcd?pli=1
     image:
@@ -1052,7 +1177,7 @@ kubernetes:
       # -- Image repository
       repository: etcd
       # -- Image tag
-      tag: 3.5.7-0
+      tag: 3.6.4-0
       # -- Image Digest
       digest: ""
       # -- Image pull policy
@@ -1113,14 +1238,37 @@ kubernetes:
     # -- Configure PodDisruptionBudget
     podDisruptionBudget: {}
     # maxUnavailable: 1
-    # We recommend giving etcd some time to start up to garantuee a healthy cluster
+    # We recommend giving etcd some time to start up to guarantee a healthy cluster
     # -- Pod Management Policy
     podManagementPolicy: OrderedReady
     # -- Minimum ready seconds
     minReadySeconds: 10
     # -- Update Strategy
     updateStrategy: {}
-
+    # livenessProbe
+    livenessProbe:
+      # -- Set failure threshold for livenessProbe
+      failureThreshold: 8
+      # -- Set initial delay seconds for livenessProbe
+      initialDelaySeconds: 15
+      # -- Set timeout seconds for livenessProbe
+      timeoutSeconds: 15
+      # -- Set path for livenessProbe
+      path: "/livez"
+      # -- Set scheme for livenessProbe
+      scheme: "HTTP"
+    # readinessProbe
+    readinessProbe:
+      # -- Set failure threshold for readinessProbe
+      failureThreshold: 3
+      # -- Set initial delay seconds for readinessProbe
+      initialDelaySeconds: 15
+      # -- Set timeout seconds for readinessProbe
+      timeoutSeconds: 5
+      # -- Set path for readinessProbe
+      path: "/readyz"
+      # -- Set scheme for readinessProbe
+      scheme: "HTTP"
     # Persistence
     persistence:
       # -- Enable Persistence for ETCD
@@ -1209,6 +1357,8 @@ kubernetes:
       ttlSecondsAfterFinished: 120
       # -- Restart Policy for ETCD Backup
       restartPolicy: OnFailure
+      # -- Image pull Secrets
+      imagePullSecrets: []
       # -- Extra arguments for ETCD Backup
       args: {}
       # -- Pod Requests and limits
@@ -1279,15 +1429,164 @@ kubernetes:
         finalizers:
           - kubernetes.io/pvc-protection
 
+    # ETCD Backup Cleanup
+    cleanup:
+      # -- Enable ETCD Backup Cleanup
+      enabled: false
+      # -- Number of days to keep backups
+      retentionDays: "7"
+      # -- Schedule for ETCD Backup Cleanup
+      schedule: "0 8 * * *"
+      # -- Successful Jobs History Limit for ETCD Backup Cleanup
+      successfulJobsHistoryLimit: 3
+      # -- Failed Jobs History Limit for ETCD Backup Cleanup
+      failedJobsHistoryLimit: 3
+      # -- ttlSecondsAfterFinished for ETCD Backup Cleanup
+      ttlSecondsAfterFinished: 120
+      # -- Restart Policy for ETCD Backup Cleanup
+      restartPolicy: OnFailure
+      # Image
+      image:
+        # -- Image registry
+        registry: docker.io
+        # -- Image repository
+        repository: busybox
+        # -- Image tag
+        tag: 1.37.0
+        # -- Image Digest
+        digest: ""
+        # -- Image pull policy
+        pullPolicy: IfNotPresent
+      # -- Image pull Secrets
+      imagePullSecrets: []
+      # -- Pod Requests and limits
+      resources: {}
+      # -- Labels for Workload
+      labels: {}
+      # -- Annotations for Workload
+      annotations: {}
+      # -- Pod Labels
+      podLabels: {}
+      # -- Pod Annotations
+      podAnnotations: {}
+      # -- Extra environment variables (`key: value` style, allows templating)
+      envs: {}
+      # -- Extra environment variables from
+      envsFrom: []
+      # -- Inject Proxy as Environment Variables
+      injectProxy: false
+      # -- Pod Security Context
+      podSecurityContext:
+        enabled: true
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      # -- Container Security Context
+      securityContext:
+        enabled: true
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        capabilities:
+          drop:
+          - ALL
+      # -- Node Selector
+      nodeSelector: {}
+      # -- Tolerations
+      tolerations: []
+      podAntiAffinity: soft
+      podAntiAffinityTopologyKey: kubernetes.io/hostname
+      # -- Affinity
+      affinity: {}
+      # -- Pod PriorityClassName
+      priorityClassName: ""
+      # -- TopologySpreadConstraints for all workloads
+      topologySpreadConstraints: []
+
+    # ETCD Defragmentation
+    defrag:
+      # -- Enable ETCD Defragmentation
+      enabled: false
+      # -- defrag-rule for ETCD Defragmentation (https://github.com/ahrtr/etcd-defrag?tab=readme-ov-file#defragmentation-rule)
+      defragRule: "dbQuotaUsage > 0.8 || dbSize - dbSizeInUse > 200*1024*1024"
+      # -- Schedule for ETCD Defragmentation
+      schedule: "0 0 1 * *"
+      # -- Successful Jobs History Limit for ETCD Defragmentation
+      successfulJobsHistoryLimit: 3
+      # -- Failed Jobs History Limit for ETCD Defragmentation
+      failedJobsHistoryLimit: 3
+      # -- ttlSecondsAfterFinished for ETCD Defragmentation
+      ttlSecondsAfterFinished: 120
+      # -- Restart Policy for ETCD Defragmentation
+      restartPolicy: OnFailure
+      # Image
+      image:
+        # -- Image registry
+        registry: ghcr.io
+        # -- Image repository
+        repository: ahrtr/etcd-defrag
+        # -- Image tag
+        tag: v0.18.0
+        # -- Image Digest
+        digest: ""
+        # -- Image pull policy
+        pullPolicy: IfNotPresent
+      # -- Image pull Secrets
+      imagePullSecrets: []
+      # -- Pod Requests and limits
+      resources: {}
+      # -- Labels for Workload
+      labels: {}
+      # -- Annotations for Workload
+      annotations: {}
+      # -- Pod Labels
+      podLabels: {}
+      # -- Pod Annotations
+      podAnnotations: {}
+      # -- Extra environment variables (`key: value` style, allows templating)
+      envs: {}
+      # -- Extra environment variables from
+      envsFrom: []
+      # -- Inject Proxy as Environment Variables
+      injectProxy: false
+      # -- Pod Security Context
+      podSecurityContext:
+        enabled: true
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      # -- Container Security Context
+      securityContext:
+        enabled: true
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        capabilities:
+          drop:
+          - ALL
+      # -- Node Selector
+      nodeSelector: {}
+      # -- Tolerations
+      tolerations: []
+      podAntiAffinity: soft
+      podAntiAffinityTopologyKey: kubernetes.io/hostname
+      # -- Affinity
+      affinity: {}
+      # -- Pod PriorityClassName
+      priorityClassName: ""
+      # -- TopologySpreadConstraints for all workloads
+      topologySpreadConstraints: []
+
   ## Kubernetes API-Server
   apiServer:
     # -- Enable Kubernetes API-Server
     enabled: true
 
+    # -- ETCD Endpoints on how the API-Server should communicate with the etcd cluster. Can be "pods" or "service"
+    etcdEndpoints: "pods"
+
     certSANs:
-      # -- Additonal API-Server dns names for ETCD ceritifcate
+      # -- Additional API-Server dns names for ETCD certificate
       dnsNames: []
-      # -- Additonal API-Server adresses for ETCD ceritifcate
+      # -- Additional API-Server addresses for ETCD certificate
       ipAddresses: []
 
     ## Ingress
@@ -1432,9 +1731,9 @@ kubernetes:
         namespace: ''
         # -- Name of the scrape_job
         jobName: ''
-        # -- Probeing Interval
+        # -- Probing Interval
         interval: ''
-        # -- Module to use for the probeing
+        # -- Module to use for the probing
         module: ''
         # -- Prober Configuration
         prober:
@@ -1453,6 +1752,58 @@ kubernetes:
         # -- Assign additional Annotations
         annotations: {}
 
+    # API Server Audit Configuration
+    audit:
+      # -- Enable Audit Log
+      enabled: false
+
+      # -- Configure Audit Backend (log, webhook, both)
+      backend: log
+
+      webhook:
+        # -- Defines the time to wait before retrying the first failed request.
+        initialBackoff: "10s"
+
+        # -- Kubeconfig for webhook
+        config: |
+          apiVersion: v1
+          kind: Config
+          clusters:
+          - name: audit-webhook
+            cluster:
+              server: https://audit-webhook.audit-webhook.svc:9443/audit
+              insecure-skip-tls-verify: false
+          contexts:
+          - name: audit-webhook
+            context:
+              cluster: audit-webhook
+              user: ""
+          current-context: audit-webhook
+          users: []
+          preferences: {}
+
+      log:
+        # -- Defines the maximum number of days to retain old audit log files
+        maxAge: "7"
+        # -- Defines the maximum number of audit log files to retain
+        maxBackup: "2"
+        # -- Defines the maximum size in megabytes of the audit log file before it gets rotated
+        maxSize: "100"
+        # -- Whether event and batch truncating is enabled
+        truncateEnabled: false
+        # -- Maximum size in bytes of the batch sent to the underlying backend
+        truncateMaxBatchSize: "10485760"
+        # -- Maximum size in bytes of the audit event sent to the underlying backend
+        truncateMaxEventSize: "102400"
+
+      # -- Audit Policy
+      policy: |
+        # Log all requests at the Metadata level.
+        apiVersion: audit.k8s.io/v1
+        kind: Policy
+        rules:
+          - level: Metadata
+
   controllerManager:
     # -- Enable Kubernetes Controller-Manager
     enabled: true
@@ -1718,8 +2069,6 @@ kubernetes:
     # -- Enable Kubernetes Administration
     enabled: true
     image:
-      # -- Use the Job Image (used for kubectl admin and kubeadmin bootstrap)
-      use_jobs: true
       # -- Image registry
       registry: ghcr.io
       # -- Image repository
@@ -1790,6 +2139,35 @@ kubernetes:
     # -- Deployment Update Strategy
     strategy: {}
 
+    # Connectivity
+    connectivity:
+      # Image Configuration
+      image:
+        # -- Image registry
+        registry: ghcr.io
+        # -- Image repository
+        repository: kvaps/kubernetes-tools
+        # -- Image pull policy
+        pullPolicy: IfNotPresent
+        # -- Image tag
+        tag: "v0.13.4"
+        # -- Image Digest
+        digest: ""
+        # -- Image pull Secrets
+        pullSecrets: []
+      # -- Container Security Context
+      securityContext:
+        enabled: true
+        allowPrivilegeEscalation: false
+        privileged: false
+        runAsUser: 20000
+        runAsGroup: 20000
+        capabilities:
+          drop:
+          - ALL
+      # -- Resources configuration
+      resources: {}
+
   # CoreDNS (via KubeADM) deployed within vcluster
   coredns:
     # -- Install CoreDNS via KubeADM
@@ -1888,7 +2266,7 @@ kubernetes:
       enabled: true
       # -- This controls the protocol between the API Server and the Konnectivity server. Supported values are "GRPC" and "HTTPConnect". "GRPC" will deploy konnectivity-server as a sidecar for apiserver. "HTTPConnect" will deploy konnectivity-server as separate deployment.
       mode: GRPC
-      # -- Enable Konnectivity Server as sidecfar for API Server
+      # -- Enable Konnectivity Server as sidecar for API Server
       sidecar: true
       # Konnectivity Server Image
       image:
@@ -1902,6 +2280,11 @@ kubernetes:
         pullPolicy: IfNotPresent
         # -- Image Digest
         digest: ""
+      controlplane:
+        # -- Enable Konnectivity Server for controlplane traffic
+        enabled: false
+        # -- This controls the protocol between the API Server and the Konnectivity server. Supported values are "GRPC" and "HTTPConnect". "GRPC" will deploy konnectivity-server as a sidecar for apiserver. "HTTPConnect" will deploy konnectivity-server as separate deployment.
+        mode: "GRPC"
       # -- Image pull Secrets
       imagePullSecrets: []
       # -- Konnectivity Server Replicas (only used in HTTPConnect mode)
@@ -2086,8 +2469,8 @@ kubernetes:
 #   Reference: https://github.com/kube-green/kube-green
 # ----------------------------
 autoscaler:
-  # -- Enable autsocaler component
-  enabled: true
+  # -- Enable autoscaler component
+  enabled: false
   ## Priorities Expander
   # -- The expanderPriorities is used if `extraArgs.expander` contains `priority` and expanderPriorities is also set with the priorities.
   # If `args.expander` contains `priority`, then expanderPriorities is used to define cluster-autoscaler-priority-expander priorities.
@@ -2135,7 +2518,7 @@ autoscaler:
     # balancing-ignore-label_1: first-label-to-ignore
     # balancing-ignore-label_2: second-label-to-ignore
 
-  # Image COnfiguration
+  # Image Configuration
   image:
     # -- Image registry
     registry: registry.k8s.io
@@ -2275,16 +2658,44 @@ autoscaler:
     # If not set and create is true, a name is generated using the fullname template
     name: ""
 
+  # Connectivity
+  connectivity:
+    # Image Configuration
+    image:
+      # -- Image registry
+      registry: ghcr.io
+      # -- Image repository
+      repository: kvaps/kubernetes-tools
+      # -- Image pull policy
+      pullPolicy: IfNotPresent
+      # -- Image tag
+      tag: "v0.13.4"
+      # -- Image Digest
+      digest: ""
+      # -- Image pull Secrets
+      pullSecrets: []
+    # -- Container Security Context
+    securityContext:
+      enabled: true
+      allowPrivilegeEscalation: false
+      privileged: false
+      runAsUser: 20000
+      runAsGroup: 20000
+      capabilities:
+        drop:
+        - ALL
+    # -- Resources configuration
+    resources: {}
+
 # ----------------------------
 # Utilities
 # ----------------------------
-# -- kubeVersion Override Kubernetes version
-kubeVersion: ""
-
 utils:
   # -- Base Label used for labels
   base_label: "app.kubernetes.io"
-  # -- Timezone
-  timezone: "Europe/Zurich"
   # -- All controllers are installed on the current cluster without expecting a virtual API
   currentcluster: false
+  # -- kubeVersion Override Kubernetes version
+  kubeVersion: ""
+  # -- Timezone
+  timezone: "Europe/Zurich"
diff --git a/ct.yaml b/ct.yaml
index 51efbc9..ad736ed 100644
--- a/ct.yaml
+++ b/ct.yaml
@@ -7,7 +7,7 @@ chart-dirs:
 chart-repos:
   - buttahtoast=https://buttahtoast.github.io/helm-charts/
   - bedag=https://bedag.github.io/helm-charts/
-  - bitnami=https://charts.bitnami.com/bitnami
+  # - bitnami=registry-1.docker.io/bitnamicharts
 validate-chart-schema: true
 validate-maintainers: false
 validate-yaml: true