diff --git a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl
index 41e7e96..972fc21 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl
+++ b/charts/cloud-security/kubernetes-cluster/templates/_helpers.tpl
@@ -3,7 +3,12 @@ meta.helm.sh/release-name: {{ .Release.Name }}
 meta.helm.sh/release-namespace: {{ .Release.Namespace }}
 {{- end }}
 
+{{- define "apiKeyTokenFilePath" -}}
+{{ print (.Values.containerSecrets.volumeMountPath) "/apikeytoken" }}
+{{- end }}
+
 {{- define "apiKeyTokenSecret" -}}
+{{- if and (not .root.Values.containerSecrets.injectExternally) (not .root.Values.containerSecrets.apiKeyTokenName) }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -20,36 +25,21 @@ stringData:
   API_KEY_TOKEN: {{ .root.Values.apiKeyToken }}
 type: Opaque
 {{- end }}
-
-{{- define "apiKeyTokenVolume" -}}
-- name: {{ .name }}
-  secret:
-    secretName: {{ .name }}
-    items:
-    - key: API_KEY_TOKEN
-      path: apikeytoken
 {{- end }}
 
-{{- define "containerImage" -}}
-{{- print .Values.containerImage.registry "/" .Values.containerImage.repository ":" (.Values.containerImage.tag | default .Chart.AppVersion)}}
+{{- define "apiKeyTokenSecretName" -}}
+{{- .Values.containerSecrets.apiKeyTokenName | default (print .Values.resourceNamePrefix "-secret" ) }}
 {{- end }}
 
-{{- define "environmentVariables" -}}
+{{- define "containerEnvironmentVariables" -}}
 env:
+{{- include .Values.containerEnvironmentVariables | nindent 2 }}
   - name: SIL_LogFormat
     value: Text
 {{- end }}
 
-
-{{- define "globalResourceName" -}}
-{{- print "tenable" "-" .root.Values.resourceNamePrefix "-" .name "-" (trunc 8 (sha256sum (print .root.Release.Namespace ":" .root.Release.Name))) }}
-{{- end }}
-
-{{- define "labels" -}}
-app.kubernetes.io/instance: {{ .Release.Name | trunc 63 | trimSuffix "-" }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-app.kubernetes.io/name: {{ .Chart.Name | trunc 63 | trimSuffix "-" }}
-app.kubernetes.io/version: {{ .Chart.Version }}
+{{- define "containerImage" -}}
+{{- print .Values.containerImage.registry "/" .Values.containerImage.repository ":" (.Values.containerImage.tag | default .Chart.AppVersion)}}
 {{- end }}
 
 {{- define "containerImagePullSecret" -}}
@@ -72,3 +62,59 @@ data:
 type: kubernetes.io/dockerconfigjson
 {{- end }}
 {{- end }}
+
+{{- define "containerImagePullSecretNames" -}}
+{{- if .root.Values.containerImage.pullSecrets }}
+  {{- toYaml .root.Values.containerImage.pullSecrets | nindent 0 }}
+{{- else -}}
+    {{- if and .root.Values.containerImage.registryUsername .root.Values.containerImage.registryPassword -}}
+- name: {{ .name | default (print .root.Values.resourceNamePrefix "-image-pull-secret") }}
+    {{- end }}
+{{- end }}
+{{- end }}
+
+
+{{- define "containerSecretsVolume" -}}
+{{- if not .Values.containerSecrets.injectExternally -}}
+- name: {{ print .Values.resourceNamePrefix "-secret" }}
+  secret:
+    items:
+    - key: API_KEY_TOKEN
+      path: apikeytoken
+    secretName: {{ include "apiKeyTokenSecretName" . }}
+{{- end }}
+{{- end }}
+
+{{- define "containerSecretsVolumeMount" -}}
+{{- if not .Values.containerSecrets.injectExternally -}}
+- mountPath: {{ .Values.containerSecrets.volumeMountPath | quote }}
+  name: {{ print .Values.resourceNamePrefix "-secret" }}
+  readOnly: true
+{{- end }}
+{{- end }}
+
+{{- define "containerSecurityContext" -}}
+allowPrivilegeEscalation: false
+capabilities:
+  drop:
+    - ALL
+runAsNonRoot: true
+runAsUser: {{ .securityContext.runAsUser }}
+{{- end }}
+
+{{- define "globalResourceName" -}}
+{{- print "tenable" "-" .root.Values.resourceNamePrefix "-" .name "-" (trunc 8 (sha256sum (print .root.Release.Namespace ":" .root.Release.Name))) }}
+{{- end }}
+
+{{- define "labels" -}}
+app.kubernetes.io/instance: {{ .Release.Name | trunc 63 | trimSuffix "-" }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/name: {{ .Chart.Name | trunc 63 | trimSuffix "-" }}
+app.kubernetes.io/version: {{ .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "podSecurityContext" -}}
+seccompProfile:
+  type: RuntimeDefault
+{{- end }}
\ No newline at end of file
diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl
index 18c74ad..5f4b240 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl
+++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/_helpers.tpl
@@ -1,3 +1,7 @@
+{{- define "admissionController.certificateSecretName" -}}
+{{ include "admissionController.resourceNamePrefix" . }}-certificate-secret
+{{- end }}
+
 {{- define "admissionController.containerImage" -}}
 {{- print .Values.containerImage.registry "/" .Values.admissionController.containerImage.repository ":" (coalesce .Values.admissionController.containerImage.tag .Values.containerImage.tag | default .Chart.AppVersion)}}
 {{- end }}
@@ -15,14 +19,10 @@ app.kubernetes.io/component: admission-controller
 {{- end }}
 
 {{- define "admissionController.tls" -}}
-{{- if .Values.admissionController.tls }}
-{{- .Values.admissionController.tls | toYaml }}
-{{ else }}
-{{- $serverCertificateAuthorityCertificate := genCA (printf "%s-ca" (include "admissionController.resourceNamePrefix" .)) 1095 -}}
-{{- $serverCertificateHostname := (printf "%s-service.%s.svc" (include "admissionController.resourceNamePrefix" .) .Release.Namespace) }}
-{{- $serverCertificate := genSignedCert $serverCertificateHostname nil (list $serverCertificateHostname) 1095 $serverCertificateAuthorityCertificate -}}
+{{ $serverCaCertificate := genCA (printf "%s-ca" (include "admissionController.resourceNamePrefix" .)) 1095 -}}
+{{ $serverCertificateHostname := (printf "%s-service.%s.svc" (include "admissionController.resourceNamePrefix" .) .Release.Namespace) }}
+{{ $serverCertificate := genSignedCert $serverCertificateHostname nil (list $serverCertificateHostname) 1095 $serverCaCertificate -}}
+serverCaCertificateBase64: {{ $serverCaCertificate.Cert | b64enc }}
 serverCertificateBase64: {{ $serverCertificate.Cert | b64enc }}
-serverCertificateAuthorityCertificateBase64: {{ $serverCertificateAuthorityCertificate.Cert | b64enc }}
 serverCertificateKeyBase64: {{ $serverCertificate.Key | b64enc }}
-{{- end }}
 {{- end }}
\ No newline at end of file
diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml
index ec01a2d..864f6db 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/deployment.yaml
@@ -41,13 +41,13 @@ spec:
       containers:
         - args: [
             "--api-key-token-file-path",
-            "/var/run/secrets/application/apikeytoken",
+            {{ include "apiKeyTokenFilePath" . | quote }},
             "--api-url",
             {{ .Values.apiUrl | quote }},
             "--health-server-port",
             {{ .Values.admissionController.healthPort | quote }},
             "--log-level",
-            "{{ .Values.admissionController.logLevel }}",
+            {{ .Values.admissionController.logLevel | quote }},
             "--validating-admission-configuration-name",
             {{ include "admissionController.resourceNamePrefix" . }}-vwc,
             "--webhook-server-certificates-directory-path",
@@ -55,7 +55,7 @@ spec:
             "--webhook-server-port",
             {{ .Values.admissionController.webhook.port | quote }}
           ]
-          {{- include "environmentVariables" . | nindent 10 }}
+          {{- include "containerEnvironmentVariables" . | nindent 10 }}
           image: {{ include "admissionController.containerImage" . }}
           imagePullPolicy: Always
           livenessProbe:
@@ -88,29 +88,17 @@ spec:
           resources:
         {{- toYaml . | nindent 12 }}
         {{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            runAsNonRoot: true
-            runAsUser: {{ .Values.runAsUser }}
+          securityContext:  
+          {{- include "containerSecurityContext" (dict "securityContext" .Values.admissionController.pod.containers.securityContext) | nindent 12 }}
           volumeMounts:
             - mountPath: "/var/run/secrets/certificates"
-              name: {{ include "admissionController.resourceNamePrefix" . }}-secret
-              readOnly: true
-            - mountPath: "/var/run/secrets/application"
-              name: {{ .Values.resourceNamePrefix }}-secret
+              name: {{ include "admissionController.resourceNamePrefix" . }}-certificate
               readOnly: true
+            {{- include "containerSecretsVolumeMount" . | nindent 12 }}
       imagePullSecrets:
-        {{- with .Values.containerImage.pullSecrets }}
-          {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - name: {{ .Values.resourceNamePrefix }}-image-pull-secret
-        {{- end }}
+        {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 8 }}
       securityContext:
-        seccompProfile:
-          type: RuntimeDefault
+        {{- include "podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ include "admissionController.resourceNamePrefix" . }}-service-account
       terminationGracePeriodSeconds: 60
       {{- with .Values.admissionController.pod.tolerations }}
@@ -118,9 +106,9 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
-        - name: {{ include "admissionController.resourceNamePrefix" . }}-secret
+        - name: {{ include "admissionController.resourceNamePrefix" . }}-certificate
           secret:
             defaultMode: 0444
-            secretName: {{ include "admissionController.resourceNamePrefix" . }}-secret
-      {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) | nindent 8 }}
+            secretName: {{ include "admissionController.certificateSecretName" . }}
+        {{- include "containerSecretsVolume" . | nindent 8 }}
 {{- end }}
\ No newline at end of file
diff --git a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml
index bb22f51..e265ae2 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/admission-controller/validating-webhook-configuration.yaml
@@ -2,22 +2,26 @@
 {{ $tls := include "admissionController.tls" . | fromYaml }}
 apiVersion: v1
 kind: Secret
+type: kubernetes.io/tls
 metadata:
   annotations:
     {{- include "annotations" . | nindent 4 }}
   labels:
     {{- include "labels" . | nindent 4 }}
     {{- include "admissionController.labels" . | nindent 4 }}
-  name: {{ include "admissionController.resourceNamePrefix" . }}-secret
+  name: {{ include "admissionController.certificateSecretName" . }}
   namespace: {{ .Release.Namespace }}
 data:
-  tls.key: {{ $tls.serverCertificateKeyBase64 }}
   tls.crt: {{ $tls.serverCertificateBase64 }}
+  tls.key: {{ $tls.serverCertificateKeyBase64 }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "-5"
     {{- include "annotations" . | nindent 4 }}
   labels:
     {{- include "labels" . | nindent 4 }}
@@ -28,7 +32,7 @@ webhooks:
   - v1
   - v1beta1
   clientConfig:
-    caBundle: {{ $tls.serverCertificateAuthorityCertificateBase64 }}
+    caBundle: {{ $tls.serverCaCertificateBase64 }}
     service:
       name: {{ include "admissionController.resourceNamePrefix" . }}-service
       namespace: {{ .Release.Namespace }}
diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml
index b6e7071..09d145a 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/connector/cluster-role.yaml
@@ -9,7 +9,73 @@ metadata:
     {{- include "connector.labels" . | nindent 4 }}
   name: {{ include "connector.globalResourceName" (dict "name" "cr" "root" .) }}
 rules:
+  {{- if .Values.connector.clusterRoleExplicitPermissions }}
+  - apiGroups: [""]
+    resources:
+      - bindings
+      - componentstatuses
+      - configmaps
+      - endpoints
+      - events
+      - limitranges
+      - namespaces
+      - nodes
+      - nodes/status
+      - persistentvolumeclaims
+      - persistentvolumes
+      - pods
+      - podtemplates
+      - replicationcontrollers
+      - resourcequotas
+      - serviceaccounts
+      - services
+      - services/status
+    verbs: ["get", "list", "watch"]
+  - apiGroups:
+      - admissionregistration.k8s.io
+      - apiextensions.k8s.io
+      - apiregistration.k8s.io
+      - apiserver.openshift.io
+      - apps
+      - apps.openshift.io
+      - authorization.openshift.io
+      - autoscaling
+      - batch
+      - build.openshift.io
+      - cloudcredential.openshift.io
+      - compliance.openshift.io
+      - config.openshift.io
+      - console.openshift.io
+      - discovery.k8s.io
+      - events.k8s.io
+      - extensions
+      - image.openshift.io
+      - ingress.operator.openshift.io
+      - machine.openshift.io
+      - machineconfiguration.openshift.io
+      - metal3.io
+      - monitoring.coreos.com
+      - network.openshift.io
+      - networking.k8s.io
+      - oauth.openshift.io
+      - observability.openshift.io
+      - operator.openshift.io
+      - operators.coreos.com
+      - policy
+      - project.openshift.io
+      - quota.openshift.io
+      - rbac.authorization.k8s.io
+      - route.openshift.io
+      - security.openshift.io
+      - storage.k8s.io
+      - template.openshift.io
+      - tuned.openshift.io
+      - user.openshift.io
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  {{- else }}
   - apiGroups: ["*"]
     resources: ["*"]
     verbs: ["get", "list", "watch"]
+  {{- end }}
 {{- end }}
\ No newline at end of file
diff --git a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml
index cd76617..c923ed2 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/connector/deployment.yaml
@@ -36,23 +36,23 @@ spec:
       automountServiceAccountToken: true
       containers:
         - args: [
-            "connector",
-            "--api-key-token-file-path",
-            "/var/run/secrets/application/apikeytoken",
-            "--api-url",
+          "connector",
+          "--api-key-token-file-path",
+            {{ include "apiKeyTokenFilePath" . | quote }},
+          "--api-url",
             {{ .Values.apiUrl | quote }},
-            {{- if .Values.connector.identity }}
-            "--identity",
-            {{- end}}
-            {{- if .Values.connector.network }}
-            "--network",
-            {{- end}}
-            {{- if .Values.proxyUrl }}
-            "--proxy-url",
+          {{- if .Values.connector.identity }}
+          "--identity",
+          {{- end }}
+          {{- if .Values.connector.network }}
+          "--network",
+          {{- end }}
+          {{- if .Values.proxyUrl }}
+          "--proxy-url",
             {{ .Values.proxyUrl | quote }},
-            {{- end}}
-          ]
-          {{- include "environmentVariables" . | nindent 10 }}
+          {{- end }}
+        ]
+          {{- include "containerEnvironmentVariables" . | nindent 10 }}
           image: {{ include "containerImage" . }}
           imagePullPolicy: Always
           name: {{ include "connector.resourceNamePrefix" . }}-container
@@ -61,30 +61,18 @@ spec:
           {{- toYaml . | nindent 12 }}
           {{- end }}
           securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            runAsNonRoot: true
-            runAsUser: {{ .Values.runAsUser }}
+            {{- include "containerSecurityContext" (dict "securityContext" .Values.pod.containers.securityContext) | nindent 12 }}
           volumeMounts:
-            - mountPath: "/var/run/secrets/application"
-              name: {{ .Values.resourceNamePrefix }}-secret
-              readOnly: true
+            {{- include "containerSecretsVolumeMount" . | nindent 12 }}
       imagePullSecrets:
-        {{- with .Values.containerImage.pullSecrets }}
-          {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - name: {{ .Values.resourceNamePrefix }}-image-pull-secret
-        {{- end }}
+        {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 8 }}
       securityContext:
-        seccompProfile:
-          type: RuntimeDefault
+        {{- include "podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ include "connector.resourceNamePrefix" . }}-service-account
       {{- with .Values.pod.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
-      {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) | nindent 8 }}
+        {{- include "containerSecretsVolume" . | nindent 8 }}
 {{- end }}
\ No newline at end of file
diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-cluster-role.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-cluster-role.yaml
index 01a74a5..70467ef 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-cluster-role.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-cluster-role.yaml
@@ -9,7 +9,6 @@ metadata:
   labels:
     {{- include "labels" . | nindent 4 }}
   name: {{ include "globalResourceName" (dict "name" "post-delete-cr" "root" .) }}
-  namespace: {{ .Release.Namespace }}
 rules:
   - apiGroups: [""]
     resources: ["namespaces"]
diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml
index 0e84e3a..eb3d1ae 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/hook-post-delete-job.yaml
@@ -14,74 +14,62 @@ spec:
   template:
     metadata:
       annotations:
-        {{- with .Values.pod.annotations }}
+        {{- with .Values.hooks.pod.annotations }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
       labels:
-        {{- with .Values.pod.labels }}
+        {{- with .Values.hooks.pod.labels }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
-      {{- with .Values.pod.affinity }}
+      {{- with .Values.hooks.pod.affinity }}
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       automountServiceAccountToken: true
       containers:
         - args: [
-            "release-post-delete",
-            "--api-key-token-file-path",
-            "/var/run/secrets/application/apikeytoken",
-            "--api-url",
-              {{ .Values.apiUrl | quote }},
-              {{- if .Values.proxyUrl }}
-            "--proxy-url",
-              {{ .Values.proxyUrl | quote }},
-              {{- end }}
-          ]
-          {{- include "environmentVariables" . | nindent 10 }}
+          "release-post-delete",
+          "--api-key-token-file-path",
+            {{ include "apiKeyTokenFilePath" . | quote }},
+          "--api-url",
+            {{ .Values.apiUrl | quote }},
+          {{- if .Values.proxyUrl }}
+          "--proxy-url",
+            {{ .Values.proxyUrl | quote }},
+          {{- end }}
+        ]
+          {{- include "containerEnvironmentVariables" . | nindent 10 }}
           image: {{ include "containerImage" . }}
           imagePullPolicy: Always
           name: {{ .Values.resourceNamePrefix }}-post-delete-container
-          {{- with .Values.pod.resources }}
+          {{- with .Values.hooks.pod.resources }}
           resources:
-          {{- toYaml . | nindent 12 }}
+            {{- toYaml . | nindent 12 }}
           {{- end }}
           securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
+            {{- include "containerSecurityContext" (dict "securityContext" .Values.hooks.pod.containers.securityContext) | nindent 12 }}
           volumeMounts:
-            - name: {{ .Values.resourceNamePrefix }}-post-delete-secret
-              mountPath: "/var/run/secrets/application"
-              readOnly: true
+            {{- include "containerSecretsVolumeMount" . | nindent 10 }}
       imagePullSecrets:
-        {{- with .Values.containerImage.pullSecrets }}
-          {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - name: {{ .Values.resourceNamePrefix }}-post-delete-image-pull-secret
-        {{- end }}
+        {{- include "containerImagePullSecretNames" (dict "name" (print .Values.resourceNamePrefix "-post-delete-image-pull-secret") "root" .) | nindent 8 }}
       restartPolicy: Never
       securityContext:
-        runAsNonRoot: true
-        runAsUser: {{ .Values.runAsUser }}
-        seccompProfile:
-          type: RuntimeDefault
+        {{- include "podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ .Values.resourceNamePrefix }}-post-delete-service-account
-      {{- with .Values.pod.tolerations }}
+      {{- with .Values.hooks.pod.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
-      {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-post-delete-secret") "root" .) | nindent 8 }}
+        {{- include "containerSecretsVolume" . | nindent 8 }}
 ---
 {{ $apiKeyTokenSecretAnnotations := 
   list 
   "helm.sh/hook: post-delete"
   "helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded"
   "helm.sh/hook-weight: \"-1\"" }}
-{{ include "apiKeyTokenSecret" (dict "name" (print .Values.resourceNamePrefix "-post-delete-secret") "root" . "annotations" $apiKeyTokenSecretAnnotations) }}
+{{ include "apiKeyTokenSecret" (dict "name" (include "apiKeyTokenSecretName" .) "root" . "annotations" $apiKeyTokenSecretAnnotations) }}
 ---
 {{ $containerImagePullSecretAnnotations :=
   list
diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-cluster-role-binding.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-cluster-role-binding.yaml
index ea0b156..20eaefa 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-cluster-role-binding.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-cluster-role-binding.yaml
@@ -5,7 +5,7 @@ metadata:
     {{- include "annotations" . | nindent 4 }}
     helm.sh/hook: pre-install, pre-upgrade
     helm.sh/hook-delete-policy: before-hook-creation, hook-succeeded
-    helm.sh/hook-weight: "-1"
+    helm.sh/hook-weight: "-4"
   labels:
     {{- include "labels" . | nindent 4 }}
   name: {{ include "globalResourceName" (dict "name" "pre-install-crb" "root" .) }}
diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml
index bf29ab9..dad1e3c 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-job.yaml
@@ -5,6 +5,7 @@ metadata:
     {{- include "annotations" . | nindent 4 }}
     helm.sh/hook: pre-install, pre-upgrade
     helm.sh/hook-delete-policy: before-hook-creation, hook-succeeded
+    helm.sh/hook-weight: "-1"
   labels:
     {{- include "labels" . | nindent 4 }}
   name: {{ .Values.resourceNamePrefix }}-pre-install-job
@@ -14,85 +15,73 @@ spec:
   template:
     metadata:
       annotations:
-        {{- with .Values.pod.annotations }}
+        {{- with .Values.hooks.pod.annotations }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
       labels:
-        {{- with .Values.pod.labels }}
+        {{- with .Values.hooks.pod.labels }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
-      {{- with .Values.pod.affinity }}
+      {{- with .Values.hooks.pod.affinity }}
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
         - args: [
-            "release-pre-install",
-            "--api-key-token-file-path",
-            "/var/run/secrets/application/apikeytoken",
-            "--api-url",
-              {{ .Values.apiUrl | quote }},
-            "--application-version",
-              {{ .Chart.AppVersion | quote }},
-            "--helm-release-name",
-              {{ print .Release.Namespace ":" .Release.Name | quote }},
-              {{- if .Values.name }}
-            "--name",
-              {{ .Values.name | quote }},
-              {{- end }}
-              {{- if .Values.proxyUrl }}
-            "--proxy-url",
-              {{ .Values.proxyUrl | quote }},
-              {{- end }}
-              {{- if .Values.accountId }}
-            "--tenant-raw-id",
-              {{ .Values.accountId | quote }}
-              {{- end }}
-          ]
-          {{- include "environmentVariables" . | nindent 10 }}
+          "release-pre-install",
+          "--api-key-token-file-path",
+            {{ include "apiKeyTokenFilePath" . | quote }},
+          "--api-url",
+            {{ .Values.apiUrl | quote }},
+          "--application-version",
+            {{ .Chart.AppVersion | quote }},
+          "--helm-release-name",
+            {{ print .Release.Namespace ":" .Release.Name | quote }},
+          {{- if .Values.name }}
+          "--name",
+            {{ .Values.name | quote }},
+          {{- end }}
+          {{- if .Values.proxyUrl }}
+          "--proxy-url",
+            {{ .Values.proxyUrl | quote }},
+          {{- end }}
+          {{- if .Values.accountId }}
+          "--tenant-raw-id",
+            {{ .Values.accountId | quote }}
+          {{- end }}
+        ]
+          {{- include "containerEnvironmentVariables" . | nindent 10 }}
           image: {{ include "containerImage" . }}
           imagePullPolicy: Always
           name: {{ .Values.resourceNamePrefix }}-pre-install-container
-          {{- with .Values.pod.resources }}
+          {{- with .Values.hooks.pod.resources }}
           resources:
           {{- toYaml . | nindent 12 }}
           {{- end }}
           securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
+            {{- include "containerSecurityContext" (dict "securityContext" .Values.hooks.pod.containers.securityContext) | nindent 12 }}
           volumeMounts:
-            - name: {{ .Values.resourceNamePrefix }}-pre-install-secret
-              mountPath: "/var/run/secrets/application"
-              readOnly: true
+          {{- include "containerSecretsVolumeMount" . | nindent 10 }}
       imagePullSecrets:
-        {{- with .Values.containerImage.pullSecrets }}
-          {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - name: {{ .Values.resourceNamePrefix }}-pre-install-image-pull-secret
-        {{- end }}
+        {{- include "containerImagePullSecretNames" (dict "name" (print .Values.resourceNamePrefix "-pre-install-image-pull-secret") "root" .) | nindent 8 }}
       restartPolicy: Never
       securityContext:
-        runAsNonRoot: true
-        runAsUser: {{ .Values.runAsUser }}
-        seccompProfile:
-          type: RuntimeDefault
+        {{- include "podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ .Values.resourceNamePrefix }}-pre-install-service-account
-      {{- with .Values.pod.tolerations }}
+      {{- with .Values.hooks.pod.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
-      {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-pre-install-secret") "root" .) | nindent 8 }}
+        {{- include "containerSecretsVolume" . | nindent 8 }}
 ---
 {{ $apiKeyTokenSecretAnnotations :=
   list
   "helm.sh/hook: pre-install, pre-upgrade"
   "helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded" 
-  "helm.sh/hook-weight: \"-1\"" }}
-{{ include "apiKeyTokenSecret" (dict "name" (print .Values.resourceNamePrefix "-pre-install-secret") "root" . "annotations" $apiKeyTokenSecretAnnotations) }}
+  "helm.sh/hook-weight: \"-2\"" }}
+{{ include "apiKeyTokenSecret" (dict "name" ( include "apiKeyTokenSecretName" .) "root" . "annotations" $apiKeyTokenSecretAnnotations) }}
 ---
 {{ $containerImagePullSecretAnnotations :=
   list
diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-service-account.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-service-account.yaml
index d03639f..42463e0 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-service-account.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/hook-pre-install-service-account.yaml
@@ -5,7 +5,7 @@ metadata:
     {{- include "annotations" . | nindent 4 }}
     helm.sh/hook: pre-install, pre-upgrade
     helm.sh/hook-delete-policy: before-hook-creation, hook-succeeded
-    helm.sh/hook-weight: "-1"
+    helm.sh/hook-weight: "-5"
   labels:
     {{- include "labels" . | nindent 4 }}
   name: {{ .Values.resourceNamePrefix }}-pre-install-service-account
diff --git a/charts/cloud-security/kubernetes-cluster/templates/hook-security-context-constraints.yaml b/charts/cloud-security/kubernetes-cluster/templates/hook-security-context-constraints.yaml
index cd0093a..aa11825 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/hook-security-context-constraints.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/hook-security-context-constraints.yaml
@@ -6,7 +6,7 @@ metadata:
     {{- include "annotations" . | nindent 4 }}
     helm.sh/hook: pre-install, pre-upgrade, post-delete
     helm.sh/hook-delete-policy: before-hook-creation, hook-failed, hook-succeeded
-    helm.sh/hook-weight: "-1"
+    helm.sh/hook-weight: "-3"
   labels:
     {{- include "labels" . | nindent 4 }}
   name: {{ include "globalResourceName" (dict "name" "hook-scc" "root" .) }}
diff --git a/charts/cloud-security/kubernetes-cluster/templates/secret.yaml b/charts/cloud-security/kubernetes-cluster/templates/secret.yaml
index 5f7d8a8..a6a20c5 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/secret.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/secret.yaml
@@ -1 +1 @@
-{{ include "apiKeyTokenSecret" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) }}
\ No newline at end of file
+{{ include "apiKeyTokenSecret" (dict "name" (include "apiKeyTokenSecretName" .) "root" .) }}
\ No newline at end of file
diff --git a/charts/cloud-security/kubernetes-cluster/templates/security-context-constraints.yaml b/charts/cloud-security/kubernetes-cluster/templates/security-context-constraints.yaml
index 5199d1c..aa0df9a 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/security-context-constraints.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/security-context-constraints.yaml
@@ -16,10 +16,10 @@ seLinuxContext:
 users:
   {{- if .Values.admissionController.enabled }}
   - system:serviceaccount:{{ .Release.Namespace }}:{{ include "admissionController.resourceNamePrefix" . }}-service-account
-  {{- end}}
+  {{- end }}
   {{- if .Values.connector.enabled }}
   - system:serviceaccount:{{ .Release.Namespace }}:{{ include "connector.resourceNamePrefix" . }}-service-account
-  {{- end}}
+  {{- end }}
   - system:serviceaccount:{{ .Release.Namespace }}:{{ include "updater.resourceNamePrefix" . }}-service-account
 volumes:
   - csi
diff --git a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml
index 4f37b8f..28afd0f 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/sensor/daemonset.yaml
@@ -33,25 +33,25 @@ spec:
       automountServiceAccountToken: true
       containers:
         - args: [
-            "--api-key-token-file-path",
-            "/var/run/secrets/application/apikeytoken",
-            "--api-url",
+          "--api-key-token-file-path",
+              {{ include "apiKeyTokenFilePath" . | quote }},
+          "--api-url",
             {{ .Values.apiUrl | quote }},
-            "--data-path",
+          "--data-path",
             {{ .Values.sensor.dataPath | quote }},
-            "--logs",
-            {{- if .Values.proxyUrl }}
-            "--proxy-url",
+          "--logs",
+          {{- if .Values.proxyUrl }}
+          "--proxy-url",
             {{ .Values.proxyUrl | quote }},
-            {{- end}}
-          ]
-          {{- include "environmentVariables" . | nindent 10 }}
+          {{- end }}
+        ]
+          {{- include "containerEnvironmentVariables" . | nindent 10 }}
           image: {{ include "sensor.containerImage" . }}
           imagePullPolicy: Always
           name: {{ include "sensor.resourceNamePrefix" . }}-container
           {{- with .Values.sensor.pod.resources }}
           resources:
-          {{- toYaml . | nindent 12 }}
+            {{- toYaml . | nindent 12 }}
           {{- end }}
           securityContext:
             privileged: true
@@ -59,30 +59,23 @@ spec:
           volumeMounts:
             - name: {{ include "sensor.resourceNamePrefix" . }}-data
               mountPath: {{ .Values.sensor.dataPath }}
-            - name: {{ .Values.resourceNamePrefix }}-secret
-              mountPath: "/var/run/secrets/application"
-              readOnly: true
+            {{- include "containerSecretsVolumeMount" . | nindent 12 }}
       hostPID: true
       imagePullSecrets:
-        {{- with .Values.containerImage.pullSecrets }}
-          {{- toYaml . | nindent 8 }}
-        {{- else }}
-        - name: {{ .Values.resourceNamePrefix }}-image-pull-secret
-        {{- end }}
+        {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 8 }}
       securityContext:
-        seccompProfile:
-          type: RuntimeDefault
+        {{- include "podSecurityContext" . | nindent 8 }}
       serviceAccountName: {{ include "sensor.resourceNamePrefix" . }}-service-account
       {{- with .Values.sensor.pod.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
-      - name: {{ include "sensor.resourceNamePrefix" . }}-data
-        hostPath:
-          path: {{ .Values.sensor.dataPath }}
-          type: DirectoryOrCreate
-      {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) | nindent 6 }}
+        - name: {{ include "sensor.resourceNamePrefix" . }}-data
+          hostPath:
+            path: {{ .Values.sensor.dataPath }}
+            type: DirectoryOrCreate
+      {{- include "containerSecretsVolume" . | nindent 6 }}
   updateStrategy:
     rollingUpdate:
       maxSurge: 0
diff --git a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml
index 967b07f..655e107 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/updater/cronjob.yaml
@@ -17,19 +17,19 @@ spec:
       template:
         metadata:
           annotations:
-            {{- with .Values.pod.annotations }}
+            {{- with .Values.updater.pod.annotations }}
               {{- toYaml . | nindent 12 }}
             {{- end }}
           labels:
             {{- include "labels" . | nindent 12 }}
             {{- include "updater.labels" . | nindent 12 }}
-            {{- with .Values.pod.labels }}
+            {{- with .Values.updater.pod.labels }}
               {{- toYaml . | nindent 12 }}
             {{- end }}
         spec:
-          {{- with .Values.pod.affinity }}
+          {{- with .Values.updater.pod.affinity }}
           affinity:
-            {{- toYaml . | nindent 14 }}
+            {{- toYaml . | nindent 12 }}
           {{- end }}
           automountServiceAccountToken: true
           restartPolicy: Never
@@ -37,60 +37,48 @@ spec:
             - args: [
               "updater",
               "--api-key-token-file-path",
-              "/var/run/secrets/application/apikeytoken",
+                {{ include "apiKeyTokenFilePath" . | quote }},
               "--api-url",
                 {{ .Values.apiUrl | quote }},
               "--application-version",
                 {{ .Chart.AppVersion | quote }},
               "--helm-release-name",
                 {{ print .Release.Namespace ":" .Release.Name | quote }},
-                {{- if .Values.name }}
+              {{- if .Values.name }}
               "--name",
                 {{ .Values.name | quote }},
-                {{- end}}
-                {{- if .Values.proxyUrl }}
+              {{- end }}
+              {{- if .Values.proxyUrl }}
               "--proxy-url",
                 {{ .Values.proxyUrl | quote }},
-                {{- end}}
-                {{- if .Values.accountId }}
+              {{- end }}
+              {{- if .Values.accountId }}
               "--tenant-raw-id",
                 {{ .Values.accountId | quote }}
-                {{- end}}
+              {{- end }}
             ]
-              {{- include "environmentVariables" . | nindent 14 }}
+              {{- include "containerEnvironmentVariables" . | nindent 14 }}
               image: {{ include "containerImage" . }}
               imagePullPolicy: Always
               name: {{ include "updater.resourceNamePrefix" . }}-container
-              {{- with .Values.pod.resources }}
+              {{- with .Values.updater.pod.resources }}
               resources:
               {{- toYaml . | nindent 16 }}
               {{- end }}
               securityContext:
-                allowPrivilegeEscalation: false
-                capabilities:
-                  drop:
-                    - ALL
-                runAsNonRoot: true
-                runAsUser: {{ .Values.runAsUser }}
+                {{- include "containerSecurityContext" (dict "securityContext" .Values.updater.pod.containers.securityContext) | nindent 16 }}
               volumeMounts:
-                - name: {{ .Values.resourceNamePrefix }}-secret
-                  mountPath: "/var/run/secrets/application"
-                  readOnly: true
+                {{- include "containerSecretsVolumeMount" . | nindent 16 }}
           imagePullSecrets:
-            {{- with .Values.containerImage.pullSecrets }}
-              {{- toYaml . | nindent 12 }}
-            {{- else }}
-            - name: {{ .Values.resourceNamePrefix }}-image-pull-secret
-            {{- end }}
+            {{- include "containerImagePullSecretNames" (dict "root" .) | nindent 12 }}
           securityContext:
-            seccompProfile:
-              type: RuntimeDefault
+            {{- include "podSecurityContext" . | nindent 12 }}
           serviceAccountName: {{ include "updater.resourceNamePrefix" . }}-service-account
-          {{- with .Values.pod.tolerations }}
+          {{- with .Values.updater.pod.tolerations }}
           tolerations:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumes:
-          {{- include "apiKeyTokenVolume" (dict "name" (print .Values.resourceNamePrefix "-secret") "root" .) | nindent 12 }}
+            {{- include "containerSecretsVolume" . | nindent 12 }}
       ttlSecondsAfterFinished: 7200
   schedule: "0 * * * *"
\ No newline at end of file
diff --git a/charts/cloud-security/kubernetes-cluster/templates/updater/role.yaml b/charts/cloud-security/kubernetes-cluster/templates/updater/role.yaml
index b916da2..73c87ed 100644
--- a/charts/cloud-security/kubernetes-cluster/templates/updater/role.yaml
+++ b/charts/cloud-security/kubernetes-cluster/templates/updater/role.yaml
@@ -9,6 +9,22 @@ metadata:
   name: {{ include "updater.resourceNamePrefix" . }}-role
   namespace: {{ .Release.Namespace }}
 rules:
-  - apiGroups: ["*"]
+  - apiGroups: 
+      - 
+      - admissionregistration.k8s.io
+      - apiextensions.k8s.io
+      - apiregistration.k8s.io
+      - apps
+      - autoscaling
+      - batch
+      - discovery.k8s.io
+      - events.k8s.io
+      - extensions
+      - policy
+      - rbac.authorization.k8s.io
+      - storage.k8s.io
     resources: ["*"]
-    verbs: ["*"]
\ No newline at end of file
+    verbs: ["*"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
\ No newline at end of file
diff --git a/charts/cloud-security/kubernetes-cluster/values.schema.json b/charts/cloud-security/kubernetes-cluster/values.schema.json
index f513da0..059c309 100644
--- a/charts/cloud-security/kubernetes-cluster/values.schema.json
+++ b/charts/cloud-security/kubernetes-cluster/values.schema.json
@@ -37,12 +37,18 @@
           "type": "string"
         },
         "networkPolicy": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "ingress": {
-            "type": "object"
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "ingress": {
+              "type": "object"
+            }
           },
+          "required": [
+            "enabled",
+            "ingress"
+          ],
           "type": "object"
         },
         "pod": {
@@ -55,6 +61,25 @@
               "properties": {},
               "type": "object"
             },
+            "containers": {
+              "properties": {
+                "securityContext": {
+                  "properties": {
+                    "runAsUser": {
+                      "type": "integer"
+                    }
+                  },
+                  "required": [
+                    "runAsUser"
+                  ],
+                  "type": "object"
+                }
+              },
+              "required": [
+                "securityContext"
+              ],
+              "type": "object"
+            },
             "labels": {
               "properties": {},
               "type": "object"
@@ -67,6 +92,14 @@
               "type": "array"
             }
           },
+          "required": [
+            "affinity",
+            "annotations",
+            "containers",
+            "labels",
+            "resources",
+            "tolerations"
+          ],
           "type": "object"
         },
         "replicas": {
@@ -95,18 +128,6 @@
           ],
           "type": "object"
         },
-        "tls": {
-          "serverCertificateAuthorityCertificateBase64": {
-            "type": "string"
-          },
-          "serverCertificateBase64": {
-            "type": "string"
-          },
-          "serverCertificateKeyBase64": {
-            "type": "string"
-          },
-          "type": "object"
-        },
         "webhook": {
           "properties": {
             "failurePolicy": {
@@ -121,7 +142,8 @@
           },
           "required": [
             "failurePolicy",
-            "port"
+            "port",
+            "timeoutSeconds"
           ],
           "type": "object"
         }
@@ -131,6 +153,8 @@
         "enabled",
         "healthPort",
         "logLevel",
+        "networkPolicy",
+        "pod",
         "replicas",
         "strategy",
         "webhook"
@@ -145,6 +169,9 @@
     },
     "connector": {
       "properties": {
+        "clusterRoleExplicitPermissions": {
+          "type": "boolean"
+        },
         "enabled": {
           "type": "boolean"
         },
@@ -156,6 +183,7 @@
         }
       },
       "required": [
+        "clusterRoleExplicitPermissions",
         "enabled",
         "identity",
         "network"
@@ -193,11 +221,51 @@
         }
       },
       "required": [
+        "pullSecrets",
         "registry",
         "repository"
       ],
       "type": "object"
     },
+    "containerEnvironmentVariables": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "name", 
+          "value"
+        ]
+      }
+    },
+    "containerSecrets": {
+      "properties": {
+        "apiKeyTokenName": {
+          "type": [
+            "null",
+            "string"
+          ]
+        },
+        "injectExternally": {
+          "type": "boolean"
+        },
+        "volumeMountPath": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "injectExternally",
+        "volumeMountPath"
+      ],
+      "type": "object"
+    },
     "name": {
       "type": [
         "null",
@@ -214,18 +282,80 @@
           "properties": {},
           "type": "object"
         },
+        "containers": {
+          "properties": {
+            "securityContext": {
+              "properties": {
+                "runAsUser": {
+                  "type": "integer"
+                }
+              },
+              "required": [
+                "runAsUser"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "securityContext"
+          ],
+          "type": "object"
+        },
         "labels": {
           "properties": {},
           "type": "object"
         },
         "resources": {
-          "properties": {},
+          "properties": {
+            "limits": {
+              "properties": {
+                "cpu": {
+                  "type": "string"
+                },
+                "memory": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "cpu",
+                "memory"
+              ],
+              "type": "object"
+            },
+            "requests": {
+              "properties": {
+                "cpu": {
+                  "type": "string"
+                },
+                "memory": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "cpu",
+                "memory"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "limits",
+            "requests"
+          ],
           "type": "object"
         },
         "tolerations": {
           "type": "array"
         }
       },
+      "required": [
+        "affinity",
+        "annotations",
+        "containers",
+        "labels",
+        "resources",
+        "tolerations"
+      ],
       "type": "object"
     },
     "proxyUrl": {
@@ -277,20 +407,63 @@
               "type": "object"
             },
             "resources": {
-              "properties": {},
+              "properties": {
+                "limits": {
+                  "properties": {
+                    "cpu": {
+                      "type": "string"
+                    },
+                    "memory": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "cpu",
+                    "memory"
+                  ],
+                  "type": "object"
+                },
+                "requests": {
+                  "properties": {
+                    "cpu": {
+                      "type": "string"
+                    },
+                    "memory": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "cpu",
+                    "memory"
+                  ],
+                  "type": "object"
+                }
+              },
+              "required": [
+                "limits",
+                "requests"
+              ],
               "type": "object"
             },
             "tolerations": {
               "type": "array"
             }
           },
+          "required": [
+            "affinity",
+            "annotations",
+            "labels",
+            "resources",
+            "tolerations"
+          ],
           "type": "object"
         }
       },
       "required": [
         "containerImage",
         "dataPath",
-        "enabled"
+        "enabled",
+        "pod"
       ],
       "type": "object"
     }
@@ -301,6 +474,9 @@
     "apiUrl",
     "connector",
     "containerImage",
+    "containerEnvironmentVariables",
+    "containerSecrets",
+    "pod",
     "resourceNamePrefix",
     "sensor"
   ]
diff --git a/charts/cloud-security/kubernetes-cluster/values.yaml b/charts/cloud-security/kubernetes-cluster/values.yaml
index b694aec..1990d73 100644
--- a/charts/cloud-security/kubernetes-cluster/values.yaml
+++ b/charts/cloud-security/kubernetes-cluster/values.yaml
@@ -12,6 +12,9 @@ admissionController:
   pod:
     affinity: {}
     annotations: {}
+    containers:
+      securityContext:
+        runAsUser: 1000
     labels: {}
     resources: {}
     tolerations: []
@@ -20,7 +23,6 @@ admissionController:
     rollingUpdate:
       maxSurge: 1
       maxUnavailable: 0
-  tls: {}
   webhook:
     failurePolicy: Ignore
     port: 8443
@@ -28,9 +30,20 @@ admissionController:
 apiKeyToken: ""
 apiUrl: ""
 connector:
+  clusterRoleExplicitPermissions: false
   enabled: true
   identity: true
   network: true
+  pod:
+    affinity: {}
+    annotations: {}
+    containers:
+      securityContext:
+        runAsUser: 1000
+    labels: {}
+    resources: {}
+    tolerations: []
+containerEnvironmentVariables: []
 containerImage:
   pullSecrets: []
   registry: containers.tenable.com
@@ -38,21 +51,38 @@ containerImage:
   registryUsername: null
   repository: cloud-security/kubernetes-cluster-manager
   tag: null
+containerSecrets:
+  apiKeyTokenName: null
+  injectExternally: false
+  volumeMountPath: "/var/run/secrets/application"
+hooks:
+  pod:
+    affinity: {}
+    annotations: {}
+    containers:
+      securityContext:
+        runAsUser: 1000
+    labels: {}
+    resources: {}
+    tolerations: []
 name: null
 pod:
   affinity: {}
   annotations: {}
+  containers:
+    securityContext:
+      runAsUser: 1000
   labels: {}
   resources:
     limits:
       cpu: "100m"
-      memory: "256Mi"
+      memory: "512Mi"
     requests:
       cpu: "100m"
-      memory: "256Mi"
+      memory: "512Mi"
   tolerations: []
+proxyUrl: null
 resourceNamePrefix: kubernetes-cluster
-runAsUser: 1000
 sensor:
   containerImage:
     repository: cloud-security/kubernetes-cluster-sensor
@@ -71,3 +101,19 @@ sensor:
         cpu: "300m"
         memory: "256Mi"
     tolerations: []
+updater:
+  pod:
+    affinity: {}
+    annotations: {}
+    containers:
+      securityContext:
+        runAsUser: 1000
+    labels: {}
+    resources:
+      limits:
+        cpu: "100m"
+        memory: "512Mi"
+      requests:
+        cpu: "100m"
+        memory: "512Mi"
+    tolerations: []
\ No newline at end of file