diff --git a/charts/jenkins/templates/_helpers.tpl b/charts/jenkins/templates/_helpers.tpl
index 8301a84..33b2d13 100644
--- a/charts/jenkins/templates/_helpers.tpl
+++ b/charts/jenkins/templates/_helpers.tpl
@@ -13,6 +13,21 @@
 {{- printf "%s-%s" (include "jenkins.name" .) .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
+{{/*
+Common labels for all Jenkins resources
+*/}}
+{{- define "jenkins.labels" -}}
+"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
+"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
+"app.kubernetes.io/instance": "{{ .Release.Name }}"
+"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+{{- if .Values.renderHelmLabels }}
+"helm.sh/chart": "{{ template "jenkins.label" .}}"
+{{- end }}
+{{- with .Values.extraLabels }}
+{{- toYaml . | nindent 0 }}
+{{- end }}
+{{- end -}}
 
 {{/*
 Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
@@ -140,6 +155,14 @@
   clouds:
   - kubernetes:
       containerCapStr: "{{ .Values.agent.containerCap }}"
+      {{- if .Values.agent.garbageCollection.enabled }}
+      garbageCollection:
+        {{- if .Values.agent.garbageCollection.namespaces }}
+        namespaces: |-
+          {{- .Values.agent.garbageCollection.namespaces | nindent 10 }}
+        {{- end }}
+        timeout: "{{ .Values.agent.garbageCollection.timeout }}"
+      {{- end }}
       {{- if .Values.agent.jnlpregistry }}
       jnlpregistry: "{{ .Values.agent.jnlpregistry }}"
       {{- end }}
@@ -164,6 +187,8 @@
       webSocket: true
       {{- end }}
       {{- end }}
+      skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}}
+      usageRestricted: {{ .Values.agent.usageRestricted | default false}}
       maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }}
       retentionTimeout: {{ .Values.agent.retentionTimeout | quote }}
       waitForPodSec: {{ .Values.agent.waitForPodSec | quote }}
@@ -171,6 +196,7 @@
       namespace: "{{ template "jenkins.agent.namespace" . }}"
       restrictedPssSecurityContext: {{ .Values.agent.restrictedPssSecurityContext }}
       serverUrl: "{{ .Values.kubernetesURL }}"
+      addMasterProxyEnvVars: {{ .Values.agent.addMasterProxyEnvVars | default false }}
       credentialsId: "{{ .Values.credentialsId }}"
       {{- if .Values.agent.enabled }}
       podLabels:
@@ -189,8 +215,18 @@
       {{- $agent := .Values.agent }}
       {{- range $name, $additionalAgent := .Values.additionalAgents }}
         {{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers)  }}
+        {{- $runAsUser := $additionalAgent.runAsUser }}
+        {{- $runAsUserSet := not (kindIs "invalid" $runAsUser) }}
+        {{- $runAsGroup := $additionalAgent.runAsGroup }}
+        {{- $runAsGroupSet := not (kindIs "invalid" $runAsGroup) }}
         {{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}}
         {{- $additionalAgent := merge $additionalAgent $agent }}
+        {{- if $runAsUserSet }}
+        {{- $_ := set $additionalAgent "runAsUser" $runAsUser }}
+        {{- end }}
+        {{- if $runAsGroupSet }}
+        {{- $_ := set $additionalAgent "runAsGroup" $runAsGroup }}
+        {{- end }}
         {{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}}
         {{- if $additionalContainersEmpty }}
         {{- $_ := set $additionalAgent "additionalContainers" list }}
@@ -224,6 +260,14 @@
       {{- with $newRoot}}
   - kubernetes:
       containerCapStr: "{{ .Values.agent.containerCap }}"
+      {{- if .Values.agent.garbageCollection.enabled }}
+      garbageCollection:
+        {{- if .Values.agent.garbageCollection.namespaces }}
+        namespaces: |-
+          {{- .Values.agent.garbageCollection.namespaces | nindent 10 }}
+        {{- end }}
+        timeout: "{{ .Values.agent.garbageCollection.timeout }}"
+      {{- end }}
       {{- if .Values.agent.jnlpregistry }}
       jnlpregistry: "{{ .Values.agent.jnlpregistry }}"
       {{- end }}
@@ -248,6 +292,8 @@
       webSocket: true
       {{- end }}
       {{- end }}
+      skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}}
+      usageRestricted: {{ .Values.agent.usageRestricted | default false}}
       maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }}
       retentionTimeout: {{ .Values.agent.retentionTimeout | quote }}
       waitForPodSec: {{ .Values.agent.waitForPodSec | quote }}
@@ -273,8 +319,18 @@
        {{- $agent := .Values.agent }}
        {{- range $name, $additionalAgent := .Values.additionalAgents }}
          {{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers)  }}
+         {{- $runAsUser := $additionalAgent.runAsUser }}
+         {{- $runAsUserSet := not (kindIs "invalid" $runAsUser) }}
+         {{- $runAsGroup := $additionalAgent.runAsGroup }}
+         {{- $runAsGroupSet := not (kindIs "invalid" $runAsGroup) }}
          {{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}}
          {{- $additionalAgent := merge $additionalAgent $agent }}
+         {{- if $runAsUserSet }}
+         {{- $_ := set $additionalAgent "runAsUser" $runAsUser }}
+         {{- end }}
+         {{- if $runAsGroupSet }}
+         {{- $_ := set $additionalAgent "runAsGroup" $runAsGroup }}
+         {{- end }}
          {{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}}
          {{- if $additionalContainersEmpty }}
          {{- $_ := set $additionalAgent "additionalContainers" list }}
@@ -297,7 +353,8 @@
   {{- /* restore root */}}
   {{- $_ := set $ "Values" $oldRoot.Values }}
   {{- end }}
-  {{- if .Values.controller.csrf.defaultCrumbIssuer.enabled }}
+  slaveAgentPort: {{ .Values.controller.agentListenerPort }}
+  {{- if and .Values.controller.csrf.defaultCrumbIssuer.enabled (eq .Chart.AppVersion (index (splitList "-" (include "controller.image.tag" .)) 0)) (lt (atoi (index (splitList "." .Chart.AppVersion) 1)) 543) }}
   crumbIssuer:
     standard:
       excludeClientIPFromCrumb: {{ if .Values.controller.csrf.defaultCrumbIssuer.proxyCompatability }}true{{ else }}false{{- end }}
@@ -366,7 +423,11 @@
           value: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "/" .Values.controller.jenkinsUriPrefix }}"
           {{- end }}
         {{- end }}
-    image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}"
+    {{- if ne .Values.agent.image.registry "" }}
+    image: "{{ tpl .Values.agent.image.registry . }}/{{ tpl .Values.agent.image.repository . }}:{{ tpl .Values.agent.image.tag . }}"
+    {{- else }}
+    image: "{{ tpl .Values.agent.image.repository . }}:{{ tpl .Values.agent.image.tag . }}"
+    {{- end }}
     {{- if .Values.agent.livenessProbe }}
     livenessProbe:
       execArgs: {{.Values.agent.livenessProbe.execArgs | quote}}
@@ -387,11 +448,11 @@
     {{- with .Values.agent.resources.requests.ephemeralStorage }}
     resourceRequestEphemeralStorage: {{.}}
     {{- end }}
-    {{- with .Values.agent.runAsUser }}
-    runAsUser: {{ . }}
+    {{- if not (kindIs "invalid" .Values.agent.runAsUser) }}
+    runAsUser: {{ .Values.agent.runAsUser }}
     {{- end }}
-    {{- with .Values.agent.runAsGroup }}
-    runAsGroup: {{ . }}
+    {{- if not (kindIs "invalid" .Values.agent.runAsGroup) }}
+    runAsGroup: {{ .Values.agent.runAsGroup }}
     {{- end }}
     ttyEnabled: {{ .Values.agent.TTYEnabled }}
     workingDir: {{ .Values.agent.workingDir }}
@@ -425,11 +486,15 @@
     resourceLimitMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.memory }}{{ else }}{{ $.Values.agent.resources.limits.memory }}{{ end }}
     resourceRequestCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.cpu }}{{ else }}{{ $.Values.agent.resources.requests.cpu }}{{ end }}
     resourceRequestMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.memory }}{{ else }}{{ $.Values.agent.resources.requests.memory }}{{ end }}
-    {{- if or $additionalContainers.runAsUser $.Values.agent.runAsUser }}
-    runAsUser: {{ $additionalContainers.runAsUser | default $.Values.agent.runAsUser }}
+    {{- if not (kindIs "invalid" $additionalContainers.runAsUser) }}
+    runAsUser: {{ $additionalContainers.runAsUser }}
+    {{- else if not (kindIs "invalid" $.Values.agent.runAsUser) }}
+    runAsUser: {{ $.Values.agent.runAsUser }}
     {{- end }}
-    {{- if or $additionalContainers.runAsGroup $.Values.agent.runAsGroup }}
-    runAsGroup: {{ $additionalContainers.runAsGroup | default $.Values.agent.runAsGroup }}
+    {{- if not (kindIs "invalid" $additionalContainers.runAsGroup) }}
+    runAsGroup: {{ $additionalContainers.runAsGroup }}
+    {{- else if not (kindIs "invalid" $.Values.agent.runAsGroup) }}
+    runAsGroup: {{ $.Values.agent.runAsGroup }}
     {{- end }}
     ttyEnabled: {{ $additionalContainers.TTYEnabled | default $.Values.agent.TTYEnabled }}
     workingDir: {{ $additionalContainers.workingDir | default $.Values.agent.workingDir }}
@@ -450,7 +515,7 @@
   {{- end }}
 {{- end }}
   idleMinutes: {{ .Values.agent.idleMinutes }}
-  instanceCap: 2147483647
+  instanceCap: {{ int .Values.agent.instanceCap }}
   {{- if .Values.agent.hostNetworking }}
   hostNetwork: {{ .Values.agent.hostNetworking }}
   {{- end }}
@@ -471,7 +536,10 @@
   nodeUsageMode: {{ quote .Values.agent.nodeUsageMode }}
   podRetention: {{ .Values.agent.podRetention }}
   showRawYaml: {{ .Values.agent.showRawYaml }}
-  serviceAccount: "{{ include "jenkins.serviceAccountAgentName" . }}"
+{{- $asaname := default (include "jenkins.serviceAccountAgentName" .) .Values.agent.serviceAccount -}}
+{{- if or (.Values.agent.useDefaultServiceAccount) (.Values.agent.serviceAccount) }}
+  serviceAccount: "{{ $asaname }}"
+{{- end }}
   slaveConnectTimeoutStr: "{{ .Values.agent.connectTimeout }}"
 {{- if .Values.agent.volumes }}
   volumes:
@@ -520,6 +588,7 @@
     {{- tpl (trim .Values.agent.yamlTemplate) . | nindent 4 }}
 {{- end }}
   yamlMergeStrategy: {{ .Values.agent.yamlMergeStrategy }}
+  inheritYamlMergeStrategy: {{ .Values.agent.inheritYamlMergeStrategy }}
 {{- end -}}
 
 {{- define "jenkins.kubernetes-version" -}}
@@ -607,6 +676,8 @@
           fieldPath: metadata.name
     - name: LABEL
       value: "{{ template "jenkins.fullname" $root }}-jenkins-config"
+    - name: HEALTH_PORT
+      value: "{{ $root.Values.controller.sidecars.configAutoReload.healthPort }}"
     - name: FOLDER
       value: "{{ $root.Values.controller.sidecars.configAutoReload.folder }}"
     - name: NAMESPACE
@@ -640,6 +711,10 @@
         {{- end -}}
     {{- end -}}
     {{- end }}
+    {{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }}
+    - name: LOG_CONFIG
+      value: "{{ $root.Values.controller.jenkinsHome }}/auto-reload/auto-reload-config.yaml"
+    {{- end }}
 
   resources:
 {{ toYaml $root.Values.controller.sidecars.configAutoReload.resources | indent 4 }}
@@ -651,5 +726,24 @@
       {{- if $root.Values.persistence.subPath }}
       subPath: {{ $root.Values.persistence.subPath }}
       {{- end }}
+    - name: tmp-volume
+      mountPath: /tmp
+    {{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }}
+    - name: auto-reload-config
+      mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload
+    - name: auto-reload-config-logs
+      mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload-logs
+    {{- end }}
+    {{- if $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts }}
+{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts) $root) | indent 4 }}
+    {{- end }}
 
 {{- end -}}
+
+{{- define "controller.replicas" -}}
+{{- $replicas := int (default 1 .Values.controller.replicas) -}}
+{{- if or (lt $replicas 0) (gt $replicas 1) -}}
+{{- fail "controller.replicas must be 0 or 1" -}}
+{{- end -}}
+{{- .Values.controller.replicas -}}
+{{- end -}}
diff --git a/charts/jenkins/templates/auto-reload-config.yaml b/charts/jenkins/templates/auto-reload-config.yaml
new file mode 100644
index 0000000..6b9ed27
--- /dev/null
+++ b/charts/jenkins/templates/auto-reload-config.yaml
@@ -0,0 +1,54 @@
+{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "jenkins.fullname" . }}-auto-reload-config
+  namespace: {{ template "jenkins.namespace" . }}
+  labels:
+    {{ include "jenkins.labels" . | nindent 4 }}
+data:
+  auto-reload-config.yaml: |-
+    version: 1
+    disable_existing_loggers: false
+    root:
+      level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }}
+      handlers:
+        {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}}
+        - console
+        {{- end }}
+        {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }}
+        - file
+        {{- end }}
+    handlers:
+      {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}}
+      console:
+        class: logging.StreamHandler
+        level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }}
+        formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }}
+      {{- end }}
+      {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }}
+      file:
+        class : logging.handlers.RotatingFileHandler
+        formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }}
+        filename: {{ .Values.controller.jenkinsHome }}/auto-reload-logs/file.log
+        maxBytes: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.maxBytes }}
+        backupCount: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.backupCount }}
+      {{- end }}
+    formatters:
+      JSON:
+        "()": logger.JsonFormatter
+        format: "%(levelname)s %(message)s"
+        rename_fields:
+          message: msg
+          levelname: level
+      LOGFMT:
+        "()": logger.LogfmtFormatter
+        keys:
+          - time
+          - level
+          - msg
+        mapping:
+          time: asctime
+          level: levelname
+          msg: message
+  {{- end }}
diff --git a/charts/jenkins/templates/config-init-scripts.yaml b/charts/jenkins/templates/config-init-scripts.yaml
index 7dd253c..89ed7dd 100644
--- a/charts/jenkins/templates/config-init-scripts.yaml
+++ b/charts/jenkins/templates/config-init-scripts.yaml
@@ -6,10 +6,7 @@
   name: {{ template "jenkins.fullname" . }}-init-scripts
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{ include "jenkins.labels" . | nindent 4 }}
 data:
 {{- range $key, $val := .Values.controller.initScripts }}
   init{{ $key }}.groovy: |-
diff --git a/charts/jenkins/templates/config.yaml b/charts/jenkins/templates/config.yaml
index 5de0b9f..c49c248 100644
--- a/charts/jenkins/templates/config.yaml
+++ b/charts/jenkins/templates/config.yaml
@@ -6,10 +6,7 @@
   name: {{ template "jenkins.fullname" . }}
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{ include "jenkins.labels" . | nindent 4 }}
 data:
   apply_config.sh: |-
     set -e
diff --git a/charts/jenkins/templates/extra-objects.yaml b/charts/jenkins/templates/extra-objects.yaml
new file mode 100644
index 0000000..c8b9a6e
--- /dev/null
+++ b/charts/jenkins/templates/extra-objects.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.extraObjects -}}
+  {{- $extraObjects := .Values.extraObjects -}}
+
+  {{- if kindIs "map" $extraObjects -}}
+    {{- $extraObjects = values $extraObjects -}}
+  {{- end -}}
+
+  {{- range $index, $object := $extraObjects -}}
+    {{- if $object }}
+---
+      {{- if kindIs "string" $object -}}
+        {{- tpl $object $ | nindent 0 -}}
+      {{- else -}}
+        {{- tpl (toYaml $object) $ | nindent 0 -}}
+      {{- end -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
diff --git a/charts/jenkins/templates/home-pvc.yaml b/charts/jenkins/templates/home-pvc.yaml
index f417d23..023295b 100644
--- a/charts/jenkins/templates/home-pvc.yaml
+++ b/charts/jenkins/templates/home-pvc.yaml
@@ -10,13 +10,7 @@
   name: {{ template "jenkins.fullname" . }}
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 {{- if .Values.persistence.labels }}
 {{ toYaml .Values.persistence.labels | indent 4 }}
 {{- end }}
@@ -34,7 +28,7 @@
 {{- if (eq "-" .Values.persistence.storageClass) }}
   storageClassName: ""
 {{- else }}
-  storageClassName: "{{ .Values.persistence.storageClass }}"
+  storageClassName: "{{ tpl .Values.persistence.storageClass . }}"
 {{- end }}
 {{- end }}
 {{- end }}
diff --git a/charts/jenkins/templates/jcasc-config.yaml b/charts/jenkins/templates/jcasc-config.yaml
index e404194..c9fdbcb 100644
--- a/charts/jenkins/templates/jcasc-config.yaml
+++ b/charts/jenkins/templates/jcasc-config.yaml
@@ -9,14 +9,12 @@
   name: {{ template "jenkins.casc.configName" (list (printf "config-%s" $key) $ )}}
   namespace: {{ template "jenkins.namespace" $root }}
   labels:
-    "app.kubernetes.io/name": {{ template "jenkins.name" $root}}
-    {{- if $root.Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
-    "app.kubernetes.io/instance": "{{ $.Release.Name }}"
-    "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
+    {{- include "jenkins.labels" $root | nindent 4 }}
     {{ template "jenkins.fullname" $root }}-jenkins-config: "true"
+{{- if $root.Values.controller.JCasC.configMapAnnotations }}
+  annotations:
+{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
+{{- end }}
 data:
   {{ $key }}.yaml: |-
 {{ tpl $val $| indent 4 }}
@@ -30,16 +28,67 @@
   name: {{ template "jenkins.casc.configName" (list "jcasc-config" $ )}}
   namespace: {{ template "jenkins.namespace" $root }}
   labels:
+    {{- include "jenkins.labels" $root | nindent 4 }}
+    {{ template "jenkins.fullname" $root }}-jenkins-config: "true"
+{{- if $root.Values.controller.JCasC.configMapAnnotations }}
+  annotations:
+{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
+{{- end }}
+data:
+  jcasc-default-config.yaml: |-
+    {{- include "jenkins.casc.defaults" . | nindent 4 }}
+{{- end}}
+{{- $configScripts := toYaml .Values.controller.JCasC.configScripts }}
+{{- if and .Values.controller.JCasC.securityRealm (not (contains "securityRealm:" $configScripts)) (not .Values.controller.JCasC.defaultConfig) }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "jenkins.casc.configName" (list "config-securityrealm" $ )}}
+  namespace: {{ template "jenkins.namespace" $root }}
+  labels:
     "app.kubernetes.io/name": {{ template "jenkins.name" $root}}
     {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}"
+    "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}"
     {{- end }}
     "app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
     "app.kubernetes.io/instance": "{{ $.Release.Name }}"
     "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
     {{ template "jenkins.fullname" $root }}-jenkins-config: "true"
+{{- if $root.Values.controller.JCasC.configMapAnnotations }}
+  annotations:
+{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
+{{- end }}
 data:
-  jcasc-default-config.yaml: |-
-    {{- include "jenkins.casc.defaults" . | nindent 4 }}
-{{- end}}
+  securityrealm.yaml: |-
+    jenkins:
+      securityRealm:
+        {{- tpl .Values.controller.JCasC.securityRealm . | nindent 8 }}
+{{- end }}
+{{- if and .Values.controller.JCasC.authorizationStrategy (not (contains "authorizationStrategy:" $configScripts)) (not .Values.controller.JCasC.defaultConfig) }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "jenkins.casc.configName" (list "config-authorizationstrategy" $ )}}
+  namespace: {{ template "jenkins.namespace" $root }}
+  labels:
+    "app.kubernetes.io/name": {{ template "jenkins.name" $root}}
+    {{- if .Values.renderHelmLabels }}
+    "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}"
+    {{- end }}
+    "app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
+    "app.kubernetes.io/instance": "{{ $.Release.Name }}"
+    "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
+    {{ template "jenkins.fullname" $root }}-jenkins-config: "true"
+{{- if $root.Values.controller.JCasC.configMapAnnotations }}
+  annotations:
+{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
+{{- end }}
+data:
+  authorizationstrategy.yaml: |-
+    jenkins:
+      authorizationStrategy:
+        {{- tpl .Values.controller.JCasC.authorizationStrategy . | nindent 8 }}
+{{- end }}
 {{- end }}
diff --git a/charts/jenkins/templates/jenkins-agent-svc.yaml b/charts/jenkins/templates/jenkins-agent-svc.yaml
index 4440b91..10b936f 100644
--- a/charts/jenkins/templates/jenkins-agent-svc.yaml
+++ b/charts/jenkins/templates/jenkins-agent-svc.yaml
@@ -5,13 +5,7 @@
   name: {{ template "jenkins.fullname" . }}-agent
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
   {{- if .Values.controller.agentListenerServiceAnnotations }}
   annotations:
     {{- toYaml .Values.controller.agentListenerServiceAnnotations | nindent 4 }}
diff --git a/charts/jenkins/templates/jenkins-aws-security-group-policies.yaml b/charts/jenkins/templates/jenkins-aws-security-group-policies.yaml
index 2f6e7a1..6ccabef 100644
--- a/charts/jenkins/templates/jenkins-aws-security-group-policies.yaml
+++ b/charts/jenkins/templates/jenkins-aws-security-group-policies.yaml
@@ -5,6 +5,8 @@
 metadata:
   name: {{ .name }}
   namespace: {{ template "jenkins.namespace" $ }}
+  labels:
+    {{ include "jenkins.labels" $ | nindent 4 }}
 spec:
   podSelector: 
     {{- toYaml .podSelector | nindent 6}}
diff --git a/charts/jenkins/templates/jenkins-controller-alerting-rules.yaml b/charts/jenkins/templates/jenkins-controller-alerting-rules.yaml
index 3fd8061..9bbdc79 100644
--- a/charts/jenkins/templates/jenkins-controller-alerting-rules.yaml
+++ b/charts/jenkins/templates/jenkins-controller-alerting-rules.yaml
@@ -10,13 +10,7 @@
   namespace: {{ template "jenkins.namespace" . }}
 {{- end }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
     {{- range $key, $val := .Values.controller.prometheus.alertingRulesAdditionalLabels }}
     {{ $key }}: {{ $val | quote }}
     {{- end}}
diff --git a/charts/jenkins/templates/jenkins-controller-backendconfig.yaml b/charts/jenkins/templates/jenkins-controller-backendconfig.yaml
index 0e8a566..8c13fe1 100644
--- a/charts/jenkins/templates/jenkins-controller-backendconfig.yaml
+++ b/charts/jenkins/templates/jenkins-controller-backendconfig.yaml
@@ -5,13 +5,7 @@
   name: {{ .Values.controller.backendconfig.name }}
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 {{- if .Values.controller.backendconfig.labels }}
 {{ toYaml .Values.controller.backendconfig.labels | indent 4 }}
 {{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-httproute.yaml b/charts/jenkins/templates/jenkins-controller-httproute.yaml
new file mode 100644
index 0000000..f2dcfc1
--- /dev/null
+++ b/charts/jenkins/templates/jenkins-controller-httproute.yaml
@@ -0,0 +1,40 @@
+{{- if .Values.controller.httpRoute.enabled }}
+{{- $root := . }}
+{{- $hostnames := (list) }}
+{{- if .Values.controller.httpRoute.reuseIngressConfiguration }}
+  {{- if .Values.controller.ingress.hostName }}
+    {{- $hostnames = append $hostnames .Values.controller.ingress.hostName }}
+  {{- end }}
+  {{- if .Values.controller.ingress.resourceRootUrl }}
+     {{- $hostnames = append $hostnames .Values.controller.ingress.resourceRootUrl }}
+  {{- end }}
+{{- else }}
+  {{- $hostnames = default (list) .Values.controller.httpRoute.hostnames }}
+{{- end }}
+apiVersion: {{ .Values.controller.httpRoute.apiVersion }}
+kind: {{ .Values.controller.httpRoute.kind }}
+metadata:
+  name: {{ include "jenkins.fullname" . }}
+  labels:
+    {{- include "jenkins.labels" . | nindent 4 }}
+  {{- if .Values.controller.httpRoute.annotations }}
+  annotations:
+    {{- tpl (toYaml .Values.controller.httpRoute.annotations) . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.controller.httpRoute.parentRefs }}
+  parentRefs:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  hostnames:
+  {{- range $hostnames }}
+    - {{ . | quote }}
+  {{- end }}
+  rules:
+{{- if .Values.controller.httpRoute.extraRules }}
+{{- toYaml .Values.controller.httpRoute.extraRules | nindent 2 }}
+{{- end }}
+  - backendRefs:
+    - name: {{ include "jenkins.fullname" $root }}
+      port: {{ $root.Values.controller.servicePort }}
+{{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-ingress.yaml b/charts/jenkins/templates/jenkins-controller-ingress.yaml
index b3b344f..53eaa25 100644
--- a/charts/jenkins/templates/jenkins-controller-ingress.yaml
+++ b/charts/jenkins/templates/jenkins-controller-ingress.yaml
@@ -11,24 +11,18 @@
 metadata:
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 {{- if .Values.controller.ingress.labels }}
 {{ toYaml .Values.controller.ingress.labels | indent 4 }}
 {{- end }}
 {{- if .Values.controller.ingress.annotations }}
   annotations:
-{{ toYaml .Values.controller.ingress.annotations | indent 4 }}
+{{ tpl (toYaml .Values.controller.ingress.annotations) . | indent 4 }}
 {{- end }}
   name: {{ template "jenkins.fullname" . }}
 spec:
 {{- if .Values.controller.ingress.ingressClassName }}
-  ingressClassName: {{ .Values.controller.ingress.ingressClassName | quote }}
+  ingressClassName: {{ tpl .Values.controller.ingress.ingressClassName . | quote }}
 {{- end }}
   rules:
   - http:
@@ -40,7 +34,7 @@
             name: {{ template "jenkins.fullname" . }}
             port:
               number: {{ .Values.controller.servicePort }}
-        pathType: ImplementationSpecific
+        pathType: {{ .Values.controller.ingress.pathType }}
 {{- else }}
           serviceName: {{ template "jenkins.fullname" . }}
           servicePort: {{ .Values.controller.servicePort }}
@@ -63,7 +57,7 @@
             name: {{ template "jenkins.fullname" . }}
             port:
               number: {{ .Values.controller.servicePort }}
-        pathType: ImplementationSpecific
+        pathType: {{ .Values.controller.ingress.pathType }}
 {{- else }}
           serviceName: {{ template "jenkins.fullname" . }}
           servicePort: {{ .Values.controller.servicePort }}
@@ -71,7 +65,26 @@
     host: {{ tpl .Values.controller.ingress.resourceRootUrl . | quote }}
 {{- end }}
 {{- if .Values.controller.ingress.tls }}
+{{- $withTlsEntries := false }}
+{{- range .Values.controller.ingress.tls }}
+  {{- if gt (len .) 0 }}
+    {{- $withTlsEntries = true }}
+  {{- end }}
+{{- end }}
+{{- if $withTlsEntries }}
   tls:
-{{ tpl (toYaml .Values.controller.ingress.tls ) . | indent 4 }}
-{{- end -}}
+{{- range .Values.controller.ingress.tls }}
+  - hosts:
+{{- range .hosts }}
+      - {{ tpl . $ | quote }}
+{{- end }}
+{{- if $.Values.controller.ingress.resourceRootUrl }}
+      - {{ tpl $.Values.controller.ingress.resourceRootUrl $ | quote }}
+{{- end }}
+{{- if .secretName }}
+    secretName: {{ tpl (.secretName | toString) $ | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
 {{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml b/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml
index 82835f2..e281b03 100644
--- a/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml
+++ b/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml
@@ -5,13 +5,7 @@
   name: "{{ .Release.Name }}-{{ .Values.controller.componentName }}"
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{ include "jenkins.labels" . | nindent 4 }}
 spec:
   podSelector:
     matchLabels:
@@ -60,13 +54,7 @@
   name: "{{ .Release.Name }}-{{ .Values.agent.componentName }}"
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{ include "jenkins.labels" . | nindent 4 }}
 spec:
   podSelector:
     matchLabels:
diff --git a/charts/jenkins/templates/jenkins-controller-pdb.yaml b/charts/jenkins/templates/jenkins-controller-pdb.yaml
index 9dc1faf..53090e5 100644
--- a/charts/jenkins/templates/jenkins-controller-pdb.yaml
+++ b/charts/jenkins/templates/jenkins-controller-pdb.yaml
@@ -12,13 +12,7 @@
   name: {{ template "jenkins.fullname" . }}-pdb
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
     {{- if .Values.controller.podDisruptionBudget.labels -}}
     {{ toYaml .Values.controller.podDisruptionBudget.labels | nindent 4 }}
     {{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-podmonitor.yaml b/charts/jenkins/templates/jenkins-controller-podmonitor.yaml
index 9a04019..b84039c 100644
--- a/charts/jenkins/templates/jenkins-controller-podmonitor.yaml
+++ b/charts/jenkins/templates/jenkins-controller-podmonitor.yaml
@@ -10,13 +10,7 @@
   namespace: {{ template "jenkins.namespace" . }}
 {{- end }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{ include "jenkins.labels" . | nindent 4 }}
 
 spec:
   endpoints:
diff --git a/charts/jenkins/templates/jenkins-controller-route.yaml b/charts/jenkins/templates/jenkins-controller-route.yaml
index 3550380..9144e10 100644
--- a/charts/jenkins/templates/jenkins-controller-route.yaml
+++ b/charts/jenkins/templates/jenkins-controller-route.yaml
@@ -5,12 +5,10 @@
   namespace: {{ template "jenkins.namespace" . }}
   labels:
     app: {{ template "jenkins.fullname" . }}
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
     component: "{{ .Release.Name }}-{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 {{- if .Values.controller.route.labels }}
 {{ toYaml .Values.controller.route.labels | indent 4 }}
 {{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-secondary-ingress.yaml b/charts/jenkins/templates/jenkins-controller-secondary-ingress.yaml
index c63e482..876b75d 100644
--- a/charts/jenkins/templates/jenkins-controller-secondary-ingress.yaml
+++ b/charts/jenkins/templates/jenkins-controller-secondary-ingress.yaml
@@ -13,26 +13,21 @@
 metadata:
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
     {{- if .Values.controller.secondaryingress.labels -}}
     {{ toYaml .Values.controller.secondaryingress.labels | nindent 4 }}
     {{- end }}
   {{- if .Values.controller.secondaryingress.annotations }}
-  annotations: {{ toYaml .Values.controller.secondaryingress.annotations | nindent 4 }}
+  annotations:
+{{ tpl (toYaml .Values.controller.secondaryingress.annotations) . | indent 4 }}
   {{- end }}
   name: {{ template "jenkins.fullname" . }}-secondary
 spec:
 {{- if .Values.controller.secondaryingress.ingressClassName }}
-  ingressClassName: {{ .Values.controller.secondaryingress.ingressClassName | quote }}
+  ingressClassName: {{ tpl .Values.controller.secondaryingress.ingressClassName . | quote }}
 {{- end }}
   rules:
-    - host: {{ .Values.controller.secondaryingress.hostName }}
+    - host: {{ tpl .Values.controller.secondaryingress.hostName . | quote }}
       http:
         paths:
         {{- range .Values.controller.secondaryingress.paths }}
@@ -43,14 +38,30 @@
                 name: {{ $serviceName }}
                 port:
                   number: {{ $servicePort }}
-            pathType: ImplementationSpecific
+            pathType: {{ $.Values.controller.secondaryingress.pathType }}
 {{ else }}
               serviceName: {{ $serviceName }}
               servicePort: {{ $servicePort }}
 {{ end }}
         {{- end}}
 {{- if .Values.controller.secondaryingress.tls }}
+{{- $withTlsEntries := false }}
+{{- range .Values.controller.secondaryingress.tls }}
+  {{- if gt (len .) 0 }}
+    {{- $withTlsEntries = true }}
+  {{- end }}
+{{- end }}
+{{- if $withTlsEntries }}
   tls:
-{{ toYaml .Values.controller.secondaryingress.tls | indent 4 }}
+{{- range .Values.controller.secondaryingress.tls }}
+  - hosts:
+{{- range .hosts }}
+      - {{ tpl . $ | quote }}
+{{- end }}
+{{- if .secretName }}
+    secretName: {{ tpl (.secretName | toString) $ | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
 {{- end -}}
 {{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-servicemonitor.yaml b/charts/jenkins/templates/jenkins-controller-servicemonitor.yaml
index 8710b2b..bf64666 100644
--- a/charts/jenkins/templates/jenkins-controller-servicemonitor.yaml
+++ b/charts/jenkins/templates/jenkins-controller-servicemonitor.yaml
@@ -10,13 +10,7 @@
   namespace: {{ template "jenkins.namespace" . }}
 {{- end }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
     {{- range $key, $val := .Values.controller.prometheus.serviceMonitorAdditionalLabels }}
     {{ $key }}: {{ $val | quote }}
     {{- end}}
diff --git a/charts/jenkins/templates/jenkins-controller-statefulset.yaml b/charts/jenkins/templates/jenkins-controller-statefulset.yaml
index ca0edc6..80154c7 100644
--- a/charts/jenkins/templates/jenkins-controller-statefulset.yaml
+++ b/charts/jenkins/templates/jenkins-controller-statefulset.yaml
@@ -8,13 +8,7 @@
   name: {{ template "jenkins.fullname" . }}
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
     {{- range $key, $val := .Values.controller.statefulSetLabels }}
     {{ $key }}: {{ $val | quote }}
     {{- end}}
@@ -24,7 +18,7 @@
   {{- end }}
 spec:
   serviceName: {{ template "jenkins.fullname" . }}
-  replicas: 1
+  replicas: {{ include "controller.replicas" . }}
   selector:
     matchLabels:
       "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
@@ -36,10 +30,7 @@
   template:
     metadata:
       labels:
-        "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-        "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-        "app.kubernetes.io/instance": "{{ .Release.Name }}"
-        "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+        {{- include "jenkins.labels" . | nindent 8 }}
         {{- range $key, $val := .Values.controller.podLabels }}
         {{ $key }}: {{ $val | quote }}
         {{- end}}
@@ -67,6 +58,14 @@
       affinity:
 {{ toYaml .Values.controller.affinity | indent 8 }}
       {{- end }}
+      {{- if .Values.controller.topologySpreadConstraints }}
+      topologySpreadConstraints:
+{{ toYaml .Values.controller.topologySpreadConstraints | indent 8 }}
+      {{- end }}
+      {{- if .Values.controller.dnsConfig }}
+      dnsConfig:
+{{ toYaml .Values.controller.dnsConfig | indent 8 }}
+      {{- end }}
       {{- if quote .Values.controller.terminationGracePeriodSeconds }}
       terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
       {{- end }}
@@ -76,6 +75,9 @@
       {{- if .Values.controller.shareProcessNamespace }}
       shareProcessNamespace: true
       {{- end }}
+      {{- if not .Values.controller.enableServiceLinks }}
+      enableServiceLinks: false
+      {{- end }}
 {{- if .Values.controller.usePodSecurityContext }}
       securityContext:
   {{- if kindIs "map" .Values.controller.podSecurityContextOverride }}
@@ -84,12 +86,14 @@
     {{/* The rest of this section should be replaced with the contents of this comment one the runAsUser, fsGroup, and securityContextCapabilities Helm chart values have been removed:
         runAsUser: 1000
         fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
         runAsNonRoot: true
     */}}
         runAsUser: {{ default 0 .Values.controller.runAsUser }}
     {{- if and (.Values.controller.runAsUser) (.Values.controller.fsGroup) }}
       {{- if not (eq (int .Values.controller.runAsUser) 0) }}
         fsGroup: {{ .Values.controller.fsGroup }}
+        fsGroupChangePolicy: {{ .Values.controller.fsGroupChangePolicy }}
         runAsNonRoot: true
       {{- end }}
       {{- if .Values.controller.securityContextCapabilities }}
@@ -100,6 +104,7 @@
   {{- end }}
 {{- end }}
       serviceAccountName: "{{ template "jenkins.serviceAccountName" . }}"
+      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 {{- if .Values.controller.hostNetworking }}
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
@@ -215,10 +220,10 @@
                   fieldPath: metadata.name
             - name: JAVA_OPTS
               value: >-
-                {{ if .Values.controller.sidecars.configAutoReload.enabled }} -Dcasc.reload.token=$(POD_NAME) {{ end }}{{ default "" .Values.controller.javaOpts }}
+                {{ if .Values.controller.sidecars.configAutoReload.enabled }} -Dcasc.reload.token=$(POD_NAME) {{ end }}{{ tpl (default "" .Values.controller.javaOpts) . }}
             - name: JENKINS_OPTS
               value: >-
-                {{ if .Values.controller.jenkinsUriPrefix }}--prefix={{ .Values.controller.jenkinsUriPrefix }} {{ end }} --webroot=/var/jenkins_cache/war {{ default "" .Values.controller.jenkinsOpts}}
+                {{ if .Values.controller.jenkinsUriPrefix }}--prefix={{ .Values.controller.jenkinsUriPrefix }} {{ end }} --webroot=/var/jenkins_cache/war {{ tpl (default "" .Values.controller.jenkinsOpts) . }}
             - name: JENKINS_SLAVE_AGENT_PORT
               value: "{{ .Values.controller.agentListenerPort }}"
             {{- if .Values.controller.httpsKeyStore.enable }}
@@ -321,6 +326,13 @@
 {{- if .Values.persistence.volumes }}
 {{ tpl (toYaml .Values.persistence.volumes | indent 6) . }}
 {{- end }}
+      {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }}
+      - name: auto-reload-config
+        configMap:
+          name: {{ template "jenkins.fullname" . }}-auto-reload-config
+      - name: auto-reload-config-logs
+        emptyDir: {}
+      {{- end }}
       {{- if .Values.controller.installPlugins }}
       {{- if .Values.controller.overwritePluginsFromImage }}
       - name: plugins
diff --git a/charts/jenkins/templates/jenkins-controller-svc.yaml b/charts/jenkins/templates/jenkins-controller-svc.yaml
index a83466c..3cf9e78 100644
--- a/charts/jenkins/templates/jenkins-controller-svc.yaml
+++ b/charts/jenkins/templates/jenkins-controller-svc.yaml
@@ -1,16 +1,11 @@
+{{- if .Values.controller.serviceEnabled }}
 apiVersion: v1
 kind: Service
 metadata:
   name: {{template "jenkins.fullname" . }}
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
     {{- if .Values.controller.serviceLabels }}
 {{ toYaml .Values.controller.serviceLabels | indent 4 }}
     {{- end }}
@@ -41,6 +36,9 @@
       targetPort: {{ $port.port }}
       {{- end -}}
 {{- end }}
+  {{- if .Values.controller.publishNotReadyAddresses }}
+  publishNotReadyAddresses: true
+  {{- end }}
   selector:
     "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
     "app.kubernetes.io/instance": "{{ .Release.Name }}"
@@ -54,3 +52,4 @@
   loadBalancerIP: {{.Values.controller.loadBalancerIP}}
   {{end}}
   {{end}}
+{{- end }}
diff --git a/charts/jenkins/templates/rbac.yaml b/charts/jenkins/templates/rbac.yaml
index 581cb8d..48ba8ab 100644
--- a/charts/jenkins/templates/rbac.yaml
+++ b/charts/jenkins/templates/rbac.yaml
@@ -8,13 +8,7 @@
   name: {{ $serviceName }}-schedule-agents
   namespace: {{ template "jenkins.agent.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 rules:
 - apiGroups: [""]
   resources: ["pods", "pods/exec", "pods/log", "persistentvolumeclaims", "events"]
@@ -33,13 +27,7 @@
   name: {{ $serviceName }}-schedule-agents
   namespace: {{ template "jenkins.agent.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -60,13 +48,7 @@
   name: {{ template "jenkins.fullname" . }}-read-secrets
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 rules:
   - apiGroups: [""]
     resources: ["secrets"]
@@ -80,13 +62,7 @@
   name: {{ $serviceName }}-read-secrets
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -99,6 +75,43 @@
 ---
 {{- end}}
 
+{{- if .Values.rbac.useOpenShiftNonRootSCC }}
+# This is needed if you are running on OpenShift and using the default
+# containerSecurityContext in the chart. It grants the Jenkins service account
+# permission to use the "nonroot" and "nonroot-v2" SecurityContextConstraints.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ $serviceName }}-use-nonroot-scc
+  namespace: {{ template "jenkins.namespace" . }}
+  labels:
+    {{- include "jenkins.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["security.openshift.io"]
+    resources: ["securitycontextconstraints"]
+    resourceNames: ["nonroot", "nonroot-v2"]
+    verbs: ["use"]
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ $serviceName }}-use-nonroot-scc
+  namespace: {{ template "jenkins.namespace" . }}
+  labels:
+    {{- include "jenkins.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "jenkins.fullname" . }}-use-nonroot-scc
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "jenkins.serviceAccountName" . }}
+    namespace: {{ template "jenkins.namespace" . }}
+
+---
+{{- end}}
+
 {{- if .Values.controller.sidecars.configAutoReload.enabled }}
 # The sidecar container which is responsible for reloading configuration changes
 # needs permissions to watch ConfigMaps
@@ -108,13 +121,7 @@
   name: {{ template "jenkins.fullname" . }}-casc-reload
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 rules:
 - apiGroups: [""]
   resources: ["configmaps"]
@@ -128,13 +135,7 @@
   name: {{ $serviceName }}-watch-configmaps
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
diff --git a/charts/jenkins/templates/secret-additional.yaml b/charts/jenkins/templates/secret-additional.yaml
index d1908aa..9504b3b 100644
--- a/charts/jenkins/templates/secret-additional.yaml
+++ b/charts/jenkins/templates/secret-additional.yaml
@@ -6,13 +6,7 @@
   name: {{ template "jenkins.fullname" . }}-additional-secrets
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{ include "jenkins.labels" . | nindent 4 }}
 type: Opaque
 data:
 {{- range .Values.controller.additionalSecrets }}
diff --git a/charts/jenkins/templates/secret-claims.yaml b/charts/jenkins/templates/secret-claims.yaml
index e8b6d6c..b47c7bd 100644
--- a/charts/jenkins/templates/secret-claims.yaml
+++ b/charts/jenkins/templates/secret-claims.yaml
@@ -1,7 +1,5 @@
 {{- if .Values.controller.secretClaims -}}
-{{- $r := .Release -}}
-{{- $v := .Values -}}
-{{- $chart := printf "%s-%s" .Chart.Name .Chart.Version -}}
+{{- $root := . -}}
 {{- $namespace := include "jenkins.namespace" . -}}
 {{- $serviceName := include "jenkins.fullname" . -}}
 {{ range .Values.controller.secretClaims }}
@@ -12,13 +10,9 @@
   name: {{ $serviceName }}-{{ .name | default .path | lower }}
   namespace: {{ $namespace }}
   labels:
-    "app.kubernetes.io/name": '{{ $serviceName }}'
-    {{- if $v.renderHelmLabels }}
-    "helm.sh/chart": "{{ $chart }}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ $r.Service }}"
-    "app.kubernetes.io/instance": "{{ $r.Name }}"
-    "app.kubernetes.io/component": "{{ $v.controller.componentName }}"
+    {{- $baseLabels := include "jenkins.labels" $root | fromYaml }}
+    {{- $overrideLabels := dict "app.kubernetes.io/name" $serviceName }}
+    {{- toYaml (merge $overrideLabels $baseLabels) | nindent 4 }}
 spec:
   type: {{ .type | default "Opaque" }}
   path: {{ .path }}
@@ -26,4 +20,4 @@
   renew: {{ .renew }}
 {{- end }}
 {{- end }}
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/charts/jenkins/templates/secret-https-jks.yaml b/charts/jenkins/templates/secret-https-jks.yaml
index 5348de4..244e1a5 100644
--- a/charts/jenkins/templates/secret-https-jks.yaml
+++ b/charts/jenkins/templates/secret-https-jks.yaml
@@ -5,13 +5,7 @@
   name: {{ template "jenkins.fullname" . }}-https-jks
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{ include "jenkins.labels" . | nindent 4 }}
 type: Opaque
 data:
   jenkins-jks-file: |
diff --git a/charts/jenkins/templates/secret.yaml b/charts/jenkins/templates/secret.yaml
index cc6ace1..a3000d1 100644
--- a/charts/jenkins/templates/secret.yaml
+++ b/charts/jenkins/templates/secret.yaml
@@ -6,13 +6,7 @@
   name: {{ template "jenkins.fullname" . }}
   namespace: {{ template "jenkins.namespace" . }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{ include "jenkins.labels" . | nindent 4 }}
 type: Opaque
 data:
   jenkins-admin-password: {{ template "jenkins.password" . }}
diff --git a/charts/jenkins/templates/service-account-agent.yaml b/charts/jenkins/templates/service-account-agent.yaml
index 48f08ba..42df234 100644
--- a/charts/jenkins/templates/service-account-agent.yaml
+++ b/charts/jenkins/templates/service-account-agent.yaml
@@ -1,6 +1,7 @@
 {{ if .Values.serviceAccountAgent.create }}
 apiVersion: v1
 kind: ServiceAccount
+automountServiceAccountToken: {{ .Values.serviceAccountAgent.automountServiceAccountToken }}
 metadata:
   name: {{ include "jenkins.serviceAccountAgentName" . }}
   namespace: {{ template "jenkins.agent.namespace" . }}
@@ -9,13 +10,7 @@
 {{ tpl (toYaml .Values.serviceAccountAgent.annotations) . | indent 4 }}
 {{- end }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 {{- if .Values.serviceAccountAgent.extraLabels }}
 {{ tpl (toYaml .Values.serviceAccountAgent.extraLabels) . | indent 4 }}
 {{- end }}
diff --git a/charts/jenkins/templates/service-account.yaml b/charts/jenkins/templates/service-account.yaml
index b44eb48..c868af5 100644
--- a/charts/jenkins/templates/service-account.yaml
+++ b/charts/jenkins/templates/service-account.yaml
@@ -1,6 +1,7 @@
 {{ if .Values.serviceAccount.create }}
 apiVersion: v1
 kind: ServiceAccount
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 metadata:
   name: {{ include "jenkins.serviceAccountName" . }}
   namespace: {{ template "jenkins.namespace" . }}
@@ -9,13 +10,7 @@
 {{ tpl (toYaml .Values.serviceAccount.annotations) . | indent 4 }}
 {{- end }}
   labels:
-    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
-    {{- if .Values.renderHelmLabels }}
-    "helm.sh/chart": "{{ template "jenkins.label" .}}"
-    {{- end }}
-    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
-    "app.kubernetes.io/instance": "{{ .Release.Name }}"
-    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+    {{- include "jenkins.labels" . | nindent 4 }}
 {{- if .Values.serviceAccount.extraLabels }}
 {{ tpl (toYaml .Values.serviceAccount.extraLabels) . | indent 4 }}
 {{- end }}