diff --git a/common/acm/templates/policies/acm-hub-ca-policy.yaml b/common/acm/templates/policies/acm-hub-ca-policy.yaml
index 890e6bae..ef15b136 100644
--- a/common/acm/templates/policies/acm-hub-ca-policy.yaml
+++ b/common/acm/templates/policies/acm-hub-ca-policy.yaml
@@ -1,5 +1,6 @@
 # This pushes out the HUB's Certificate Authorities on to the imported clusters
-{{ if .Values.clusterGroup.isHubCluster }}
+{{- if .Values.clusterGroup.isHubCluster }}
+{{- if (eq (((.Values.global).secretStore).backend) "vault") }}
 ---
 apiVersion: policy.open-cluster-management.io/v1
 kind: Policy
@@ -31,7 +32,7 @@ spec:
                 type: Opaque
                 metadata:
                   name: hub-ca
-                  namespace: imperative
+                  namespace: golang-external-secrets
                 data:
                   hub-kube-root-ca.crt: '{{ `{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | base64enc hub}}` }}'
                   hub-openshift-service-ca.crt: '{{ `{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | base64enc hub}}` }}'
@@ -67,5 +68,5 @@ spec:
         operator: NotIn
         values:
           - 'true'
-{{ end }}
-
+{{- end }}
+{{- end }}
diff --git a/common/acm/templates/policies/application-policies.yaml b/common/acm/templates/policies/application-policies.yaml
index 131f4f3e..2a815913 100644
--- a/common/acm/templates/policies/application-policies.yaml
+++ b/common/acm/templates/policies/application-policies.yaml
@@ -43,9 +43,14 @@ spec:
                     path: {{ default "common/clustergroup" .path }}
                     helm:
                       ignoreMissingValueFiles: true
+                      values: |
+                        extraParametersNested:
+                        {{- range $k, $v := $.Values.extraParametersNested }}
+                          {{ $k }}: {{ printf "%s" $v | quote }}
+                        {{- end }}
                       valueFiles:
                       {{- include "acm.app.policies.valuefiles" . | nindent 22 }}
-                      {{- range $valueFile := $.Values.global.extraValueFiles }}
+                      {{- range $valueFile := .extraValueFiles }}
                       - {{ $valueFile | quote }}
                       {{- end }}
                       parameters:
@@ -73,6 +78,10 @@ spec:
                         value: {{ $group.name }}
                       - name: global.experimentalCapabilities
                         value: {{ $.Values.global.experimentalCapabilities }}
+                      {{- range $k, $v := $.Values.extraParametersNested }}
+                      - name: {{ $k }}
+                        value: {{ printf "%s" $v | quote }}
+                      {{- end }}
                      {{- range .helmOverrides }}
                       - name: {{ .name }}
                         value: {{ .value | quote }}
diff --git a/common/acm/templates/policies/ocp-gitops-policy.yaml b/common/acm/templates/policies/ocp-gitops-policy.yaml
index bec5b343..e72434ae 100644
--- a/common/acm/templates/policies/ocp-gitops-policy.yaml
+++ b/common/acm/templates/policies/ocp-gitops-policy.yaml
@@ -140,7 +140,7 @@ spec:
                       - -c
                       - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt > /tmp/ca-bundles/ca-bundle.crt
                         || true
-                      image: registry.access.redhat.com/ubi9/ubi-minimal:latest
+                      image: registry.redhat.io/ubi9/ubi-minimal:latest
                       name: fetch-ca
                       resources: {}
                       volumeMounts:
@@ -195,6 +195,11 @@ spec:
                         memory: 128Mi
                     route:
                       enabled: true
+                      {{- if and (.Values.global.argocdServer) (.Values.global.argocdServer.route) (.Values.global.argocdServer.route.tls) }}
+                      tls:
+                        insecureEdgeTerminationPolicy: {{ default "Redirect" .Values.global.argocdServer.route.tls.insecureEdgeTerminationPolicy }}
+                        termination: {{ default "reencrypt" .Values.global.argocdServer.route.tls.termination }}
+                      {{- end }}
                     service:
                       type: ""
                   sso:
diff --git a/common/acm/values.yaml b/common/acm/values.yaml
index c5f222c9..6919b419 100644
--- a/common/acm/values.yaml
+++ b/common/acm/values.yaml
@@ -9,6 +9,8 @@ global:
   targetRevision: main
   options:
     applicationRetryLimit: 20
+  secretStore:
+    backend: "vault"
 
 clusterGroup:
   subscriptions:
diff --git a/common/ansible/roles/iib_ci/README.md b/common/ansible/roles/iib_ci/README.md
index 36784ed5..8c654dbb 100644
--- a/common/ansible/roles/iib_ci/README.md
+++ b/common/ansible/roles/iib_ci/README.md
@@ -52,12 +52,17 @@ make EXTRA_HELM_OPTS="--set main.gitops.operatorSource=iib-${IIB} --set main.git
 The advanced-cluster-management operator is a little bit more complex than the others because it
 also installes another operator called MCE multicluster-engine. So to install ACM you typically
 need two IIBs (one for acm and one for mce). With those two at hand, do the following (the ordering must be
-consistent: the first IIB corresponds to the first OPERATOR, etc).
+consistent: the first IIB corresponds to the first OPERATOR, etc). The following operation needs to be done
+on both hub *and* spokes:
 
 ```sh
-export OPERATOR=advanced-cluster-management,multicluster-engine
-export INDEX_IMAGES=registry-proxy.engineering.redhat.com/rh-osbs/iib:713808,registry-proxy.engineering.redhat.com/rh-osbs/iib:718034
-make load-iib
+for i in hub-kubeconfig-file spoke-kubeconfig-file; do
+  export KUBECONFIG="${i}"
+  export KUBEADMINPASS="11111-22222-33333-44444"
+  export OPERATOR=advanced-cluster-management,multicluster-engine
+  export INDEX_IMAGES=registry-proxy.engineering.redhat.com/rh-osbs/iib:713808,registry-proxy.engineering.redhat.com/rh-osbs/iib:718034
+  make load-iib
+done
 ```
 
 Once the IIBs are loaded into the cluster we need to run the following steps:
diff --git a/common/ansible/roles/iib_ci/tasks/main.yml b/common/ansible/roles/iib_ci/tasks/main.yml
index fcaad76a..4e8df11f 100644
--- a/common/ansible/roles/iib_ci/tasks/main.yml
+++ b/common/ansible/roles/iib_ci/tasks/main.yml
@@ -17,6 +17,9 @@
   ansible.builtin.shell: |
     oc get openshiftcontrollermanager/cluster -o yaml -o jsonpath='{.status.version}'
   register: oc_version_raw
+  retries: 10
+  delay: 10
+  until: oc_version_raw is not failed
   changed_when: false
 
 - name: Is OCP pre OCP 4.13? (aka registry supports v2 manifests)
diff --git a/common/clustergroup/templates/imperative/clusterrole.yaml b/common/clustergroup/templates/imperative/clusterrole.yaml
index e3646917..0ad8ff64 100644
--- a/common/clustergroup/templates/imperative/clusterrole.yaml
+++ b/common/clustergroup/templates/imperative/clusterrole.yaml
@@ -1,5 +1,6 @@
 {{- if not (eq .Values.enabled "plumbing") }}
 {{/* This is always defined as we always unseal the cluster with an imperative job */}}
+{{- if $.Values.clusterGroup.imperative.serviceAccountCreate }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -18,4 +19,19 @@ rules:
     - list
     - watch
 {{- end }}
+{{- end }} {{/* if $.Values.clusterGroup.imperative.serviceAccountCreate */}}
+{{- if $.Values.clusterGroup.imperative.adminServiceAccountCreate }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ $.Values.clusterGroup.imperative.adminClusterRoleName }}
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+{{- end }} {{/* if $.Values.clusterGroup.imperative.adminServiceAccountCreate */}}
 {{- end }}
diff --git a/common/clustergroup/templates/imperative/rbac.yaml b/common/clustergroup/templates/imperative/rbac.yaml
index 1a4b3e2b..8bfad5b3 100644
--- a/common/clustergroup/templates/imperative/rbac.yaml
+++ b/common/clustergroup/templates/imperative/rbac.yaml
@@ -1,10 +1,11 @@
 {{- if not (eq .Values.enabled "plumbing") }}
 {{/* This is always defined as we always unseal the cluster with an imperative job */}}
+{{- if $.Values.clusterGroup.imperative.serviceAccountCreate -}}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ $.Values.clusterGroup.imperative.namespace }}-cluster-admin-rolebinding
+  name: {{ $.Values.clusterGroup.imperative.namespace }}-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -17,7 +18,7 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ $.Values.clusterGroup.imperative.namespace }}-admin-rolebinding
+  name: {{ $.Values.clusterGroup.imperative.namespace }}-rolebinding
   namespace: {{ $.Values.clusterGroup.imperative.namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -28,3 +29,19 @@ subjects:
     name: {{ $.Values.clusterGroup.imperative.serviceAccountName }}
     namespace: {{ $.Values.clusterGroup.imperative.namespace }}
 {{- end }}
+{{- if $.Values.clusterGroup.imperative.adminServiceAccountCreate }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $.Values.clusterGroup.imperative.namespace }}-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ $.Values.clusterGroup.imperative.adminClusterRoleName }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ $.Values.clusterGroup.imperative.adminServiceAccountName }}
+    namespace: {{ $.Values.clusterGroup.imperative.namespace }}
+{{- end }}
+{{- end }}
diff --git a/common/clustergroup/templates/imperative/serviceaccount.yaml b/common/clustergroup/templates/imperative/serviceaccount.yaml
index ac051348..a171d300 100644
--- a/common/clustergroup/templates/imperative/serviceaccount.yaml
+++ b/common/clustergroup/templates/imperative/serviceaccount.yaml
@@ -1,10 +1,18 @@
 {{- if not (eq .Values.enabled "plumbing") }}
 {{/* This is always defined as we always unseal the cluster with an imperative job */}}
-{{- if $.Values.clusterGroup.imperative.serviceAccountCreate -}}
+{{- if $.Values.clusterGroup.imperative.serviceAccountCreate }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ $.Values.clusterGroup.imperative.serviceAccountName }}
   namespace: {{ $.Values.clusterGroup.imperative.namespace }}
 {{- end }}
+{{- if $.Values.clusterGroup.imperative.adminServiceAccountCreate }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ $.Values.clusterGroup.imperative.adminServiceAccountName }}
+  namespace: {{ $.Values.clusterGroup.imperative.namespace }}
+{{- end }}
 {{- end }}
diff --git a/common/clustergroup/templates/plumbing/applications.yaml b/common/clustergroup/templates/plumbing/applications.yaml
index 29db6f39..870babe3 100644
--- a/common/clustergroup/templates/plumbing/applications.yaml
+++ b/common/clustergroup/templates/plumbing/applications.yaml
@@ -149,6 +149,11 @@ spec:
       {{- else }}
       helm:
         ignoreMissingValueFiles: true
+        values: |
+          extraParametersNested: 
+          {{- range $k, $v := $.Values.extraParametersNested }}
+            {{ $k }}: {{ printf "%s" $v | quote }}
+          {{- end }}
         valueFiles:
         {{- include "clustergroup.app.globalvalues.prefixedvaluefiles" $ | nindent 8 }}
         {{- range $valueFile := $.Values.clusterGroup.sharedValueFiles }}
@@ -216,6 +221,11 @@ spec:
     {{- else if not .kustomize }}
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
+          {{- range $k, $v := $.Values.extraParametersNested }}
+            {{ $k }}: {{ printf "%s" $v | quote }}
+          {{- end }}
       valueFiles:
       {{- include "clustergroup.app.globalvalues.valuefiles" $ | nindent 6 }}
       {{- range $valueFile := $.Values.clusterGroup.sharedValueFiles }}
diff --git a/common/clustergroup/templates/plumbing/argocd-super-role.yaml b/common/clustergroup/templates/plumbing/argocd-super-role.yaml
index 2d5f8f76..11366a0b 100644
--- a/common/clustergroup/templates/plumbing/argocd-super-role.yaml
+++ b/common/clustergroup/templates/plumbing/argocd-super-role.yaml
@@ -4,6 +4,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -22,6 +26,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ $.Values.global.pattern }}-{{ .Values.clusterGroup.name }}-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/common/clustergroup/values.schema.json b/common/clustergroup/values.schema.json
index 071805fe..ea115f2a 100644
--- a/common/clustergroup/values.schema.json
+++ b/common/clustergroup/values.schema.json
@@ -65,6 +65,10 @@
         "clusterGroupName": {
           "type": "string"
         },
+        "extraParameters": {
+          "type": "array",
+          "description": "Pass in extra Helm parameters to all ArgoCD Applications and the framework."
+        },
         "experimentalCapabilities": {
           "type": "string",
           "description": "String to enable certain experimental capabilities in the operator and the framework."
@@ -677,6 +681,15 @@
         },
         "roleYaml": {
           "type": "string"
+        },
+        "adminServiceAccountCreate": {
+          "type": "boolean"
+        },
+        "adminServiceAccountName": {
+          "type": "string"
+        },
+        "adminClusterRoleName": {
+          "type": "string"
         }
       },
       "required": [
diff --git a/common/clustergroup/values.yaml b/common/clustergroup/values.yaml
index c74db48c..c3611241 100644
--- a/common/clustergroup/values.yaml
+++ b/common/clustergroup/values.yaml
@@ -51,6 +51,10 @@ clusterGroup:
     clusterRoleYaml: ""
     roleName: imperative-role
     roleYaml: ""
+    adminServiceAccountCreate: true
+    adminServiceAccountName: imperative-admin-sa
+    adminClusterRoleName: imperative-admin-cluster-role
+
   managedClusterGroups: {}
   namespaces: []
 #  - name: factory
diff --git a/common/golang-external-secrets/Chart.yaml b/common/golang-external-secrets/Chart.yaml
index 961f3b29..4aef19aa 100644
--- a/common/golang-external-secrets/Chart.yaml
+++ b/common/golang-external-secrets/Chart.yaml
@@ -6,6 +6,6 @@ name: golang-external-secrets
 version: 0.0.3
 dependencies:
   - name: external-secrets
-    version: "0.9.16"
+    version: "0.9.18"
     repository: "https://charts.external-secrets.io"
     #"https://external-secrets.github.io/kubernetes-external-secrets"
diff --git a/common/golang-external-secrets/charts/external-secrets-0.9.16.tgz b/common/golang-external-secrets/charts/external-secrets-0.9.16.tgz
deleted file mode 100644
index ca268d84..00000000
Binary files a/common/golang-external-secrets/charts/external-secrets-0.9.16.tgz and /dev/null differ
diff --git a/common/golang-external-secrets/charts/external-secrets-0.9.18.tgz b/common/golang-external-secrets/charts/external-secrets-0.9.18.tgz
new file mode 100644
index 00000000..7aa6d450
Binary files /dev/null and b/common/golang-external-secrets/charts/external-secrets-0.9.18.tgz differ
diff --git a/common/golang-external-secrets/values.yaml b/common/golang-external-secrets/values.yaml
index 8d30c3df..8c1cab77 100644
--- a/common/golang-external-secrets/values.yaml
+++ b/common/golang-external-secrets/values.yaml
@@ -23,7 +23,7 @@ golangExternalSecrets:
       type: Secret
       name: hub-ca
       key: hub-kube-root-ca.crt
-      namespace: imperative
+      namespace: golang-external-secrets
 
 global:
   hubClusterDomain: hub.example.com
@@ -37,10 +37,10 @@ clusterGroup:
 
 external-secrets:
   image:
-    tag: v0.9.16-ubi
+    tag: v0.9.18-ubi
   webhook:
     image:
-      tag: v0.9.16-ubi
+      tag: v0.9.18-ubi
   certController:
     image:
-      tag: v0.9.16-ubi
+      tag: v0.9.18-ubi
diff --git a/common/hashicorp-vault/values.yaml b/common/hashicorp-vault/values.yaml
index fa73a060..691f7094 100644
--- a/common/hashicorp-vault/values.yaml
+++ b/common/hashicorp-vault/values.yaml
@@ -48,4 +48,4 @@ vault:
         termination: "reencrypt"
     image:
       repository: "registry.connect.redhat.com/hashicorp/vault"
-      tag: "1.16.1-ubi"
+      tag: "1.16.2-ubi"
diff --git a/common/operator-install/templates/pattern.yaml b/common/operator-install/templates/pattern.yaml
index ca3234f8..728726f0 100644
--- a/common/operator-install/templates/pattern.yaml
+++ b/common/operator-install/templates/pattern.yaml
@@ -12,9 +12,6 @@ spec:
     tokenSecret: {{ .Values.main.tokenSecret }}
     tokenSecretNamespace: {{ .Values.main.tokenSecretNamespace }}
 {{- end }} {{/* if and .Values.main.tokenSecret .Values.main.tokenSecretNamespace */}}
-  gitOpsSpec:
-    operatorChannel: {{ default "gitops-1.12" .Values.main.gitops.channel }}
-    operatorSource: {{ default "redhat-operators" .Values.main.gitops.operatorSource }}
   multiSourceConfig:
     enabled: {{ .Values.main.multiSourceConfig.enabled }}
 {{- if .Values.main.analyticsUUID }}
diff --git a/common/operator-install/templates/subscription.yaml b/common/operator-install/templates/subscription.yaml
index 41d0d211..e8285cae 100644
--- a/common/operator-install/templates/subscription.yaml
+++ b/common/operator-install/templates/subscription.yaml
@@ -7,7 +7,10 @@ metadata:
     operators.coreos.com/patterns-operator.openshift-operators: ""
 spec:
   channel: {{ .Values.main.patternsOperator.channel }}
-  installPlanApproval: Automatic
+  installPlanApproval: {{ .Values.main.patternsOperator.installPlanApproval }}
   name: patterns-operator
   source: {{ .Values.main.patternsOperator.source }}
-  sourceNamespace: openshift-marketplace
+  sourceNamespace: {{ .Values.main.patternsOperator.sourceNamespace }}
+  {{- if .Values.main.patternsOperator.startingCSV }}
+  startingCSV: {{ .Values.main.patternsOperator.startingCSV }}
+  {{- end }}
diff --git a/common/operator-install/values.yaml b/common/operator-install/values.yaml
index 8ce7fe67..a46cca2e 100644
--- a/common/operator-install/values.yaml
+++ b/common/operator-install/values.yaml
@@ -20,6 +20,9 @@ main:
   patternsOperator:
     channel: fast
     source: community-operators
+    installPlanApproval: Automatic
+    sourceNamespace: openshift-marketplace
+    startingCSV: null
 
   clusterGroupName: default
 
diff --git a/common/tests/acm-industrial-edge-hub.expected.yaml b/common/tests/acm-industrial-edge-hub.expected.yaml
index 453e8a9e..4199ba03 100644
--- a/common/tests/acm-industrial-edge-hub.expected.yaml
+++ b/common/tests/acm-industrial-edge-hub.expected.yaml
@@ -167,7 +167,7 @@ spec:
                 type: Opaque
                 metadata:
                   name: hub-ca
-                  namespace: imperative
+                  namespace: golang-external-secrets
                 data:
                   hub-kube-root-ca.crt: '{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | base64enc hub}}'
                   hub-openshift-service-ca.crt: '{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | base64enc hub}}'
@@ -214,6 +214,8 @@ spec:
                     path: common/clustergroup
                     helm:
                       ignoreMissingValueFiles: true
+                      values: |
+                        extraParametersNested:
                       valueFiles:
                       - "/values-global.yaml"
                       - "/values-factory.yaml"
diff --git a/common/tests/acm-medical-diagnosis-hub.expected.yaml b/common/tests/acm-medical-diagnosis-hub.expected.yaml
index 8b50de7a..f2a8fdd6 100644
--- a/common/tests/acm-medical-diagnosis-hub.expected.yaml
+++ b/common/tests/acm-medical-diagnosis-hub.expected.yaml
@@ -158,7 +158,7 @@ spec:
                 type: Opaque
                 metadata:
                   name: hub-ca
-                  namespace: imperative
+                  namespace: golang-external-secrets
                 data:
                   hub-kube-root-ca.crt: '{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | base64enc hub}}'
                   hub-openshift-service-ca.crt: '{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | base64enc hub}}'
@@ -205,6 +205,8 @@ spec:
                     path: common/clustergroup
                     helm:
                       ignoreMissingValueFiles: true
+                      values: |
+                        extraParametersNested:
                       valueFiles:
                       - "/values-global.yaml"
                       - "/values-region-one.yaml"
diff --git a/common/tests/acm-normal.expected.yaml b/common/tests/acm-normal.expected.yaml
index 66f1c590..143de18b 100644
--- a/common/tests/acm-normal.expected.yaml
+++ b/common/tests/acm-normal.expected.yaml
@@ -561,7 +561,7 @@ spec:
                 type: Opaque
                 metadata:
                   name: hub-ca
-                  namespace: imperative
+                  namespace: golang-external-secrets
                 data:
                   hub-kube-root-ca.crt: '{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | base64enc hub}}'
                   hub-openshift-service-ca.crt: '{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | base64enc hub}}'
@@ -608,6 +608,8 @@ spec:
                     path: common/clustergroup
                     helm:
                       ignoreMissingValueFiles: true
+                      values: |
+                        extraParametersNested:
                       valueFiles:
                       - "/values-global.yaml"
                       - "/values-acm-edge.yaml"
@@ -704,6 +706,8 @@ spec:
                     path: common/clustergroup
                     helm:
                       ignoreMissingValueFiles: true
+                      values: |
+                        extraParametersNested:
                       valueFiles:
                       - "/values-global.yaml"
                       - "/values-acm-provision-edge.yaml"
diff --git a/common/tests/clustergroup-industrial-edge-factory.expected.yaml b/common/tests/clustergroup-industrial-edge-factory.expected.yaml
index f34b5f18..4e18f8cb 100644
--- a/common/tests/clustergroup-industrial-edge-factory.expected.yaml
+++ b/common/tests/clustergroup-industrial-edge-factory.expected.yaml
@@ -64,6 +64,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -116,6 +123,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -264,11 +274,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -278,12 +301,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -303,6 +344,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: mypattern-factory-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -340,7 +385,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -522,6 +567,8 @@ spec:
     path: charts/datacenter/opendatahub
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-factory.yaml"
diff --git a/common/tests/clustergroup-industrial-edge-hub.expected.yaml b/common/tests/clustergroup-industrial-edge-hub.expected.yaml
index 6641ff73..1af3211d 100644
--- a/common/tests/clustergroup-industrial-edge-hub.expected.yaml
+++ b/common/tests/clustergroup-industrial-edge-hub.expected.yaml
@@ -109,6 +109,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -237,6 +244,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -425,11 +435,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -439,12 +462,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -464,6 +505,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: mypattern-datacenter-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -501,7 +546,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -820,6 +865,8 @@ spec:
     path: common/acm
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -885,6 +932,8 @@ spec:
     path: charts/datacenter/opendatahub
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -941,6 +990,8 @@ spec:
     path: charts/datacenter/pipelines
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -997,6 +1048,8 @@ spec:
     path: charts/datacenter/manuela-data-lake
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -1083,6 +1136,8 @@ spec:
     path: charts/datacenter/external-secrets
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -1139,6 +1194,8 @@ spec:
     path: common/golang-external-secrets
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -1222,6 +1279,8 @@ spec:
     chart: vault
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
diff --git a/common/tests/clustergroup-medical-diagnosis-hub.expected.yaml b/common/tests/clustergroup-medical-diagnosis-hub.expected.yaml
index a61ce547..2d9a4d36 100644
--- a/common/tests/clustergroup-medical-diagnosis-hub.expected.yaml
+++ b/common/tests/clustergroup-medical-diagnosis-hub.expected.yaml
@@ -109,6 +109,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -220,6 +227,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -352,11 +362,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -366,12 +389,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -391,6 +432,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: mypattern-hub-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -428,7 +473,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -705,6 +750,8 @@ spec:
     path: common/golang-external-secrets
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -761,6 +808,8 @@ spec:
     path: charts/all/kafdrop
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -817,6 +866,8 @@ spec:
     path: charts/all/kafka
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -873,6 +924,8 @@ spec:
     path: charts/all/opendatahub
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -929,6 +982,8 @@ spec:
     path: charts/all/openshift-data-foundations
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -985,6 +1040,8 @@ spec:
     path: charts/all/openshift-serverless
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1041,6 +1098,8 @@ spec:
     path: charts/all/medical-diagnosis/service-account
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1097,6 +1156,8 @@ spec:
     chart: vault
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1171,6 +1232,8 @@ spec:
     path: charts/all/medical-diagnosis/database
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1227,6 +1290,8 @@ spec:
     path: charts/all/medical-diagnosis/grafana
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1283,6 +1348,8 @@ spec:
     path: charts/all/medical-diagnosis/image-generator
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1348,6 +1415,8 @@ spec:
     path: charts/all/medical-diagnosis/image-server
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1413,6 +1482,8 @@ spec:
     path: charts/all/medical-diagnosis/xray-init
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
diff --git a/common/tests/clustergroup-naked.expected.yaml b/common/tests/clustergroup-naked.expected.yaml
index fdaf4293..a7fee415 100644
--- a/common/tests/clustergroup-naked.expected.yaml
+++ b/common/tests/clustergroup-naked.expected.yaml
@@ -28,6 +28,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -43,6 +50,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -117,11 +127,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -131,12 +154,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -156,6 +197,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: common-example-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -193,7 +238,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/common/tests/clustergroup-normal.expected.yaml b/common/tests/clustergroup-normal.expected.yaml
index 93f6892a..7bb75394 100644
--- a/common/tests/clustergroup-normal.expected.yaml
+++ b/common/tests/clustergroup-normal.expected.yaml
@@ -96,6 +96,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -128,6 +135,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -314,11 +324,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -328,12 +351,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -353,6 +394,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: mypattern-example-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -390,7 +435,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -670,6 +715,8 @@ spec:
     path: common/acm
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-example.yaml"
@@ -737,6 +784,8 @@ spec:
     path: charts/datacenter/pipelines
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-example.yaml"
diff --git a/common/tests/golang-external-secrets-industrial-edge-factory.expected.yaml b/common/tests/golang-external-secrets-industrial-edge-factory.expected.yaml
index f0969200..f7aee2c2 100644
--- a/common/tests/golang-external-secrets-industrial-edge-factory.expected.yaml
+++ b/common/tests/golang-external-secrets-industrial-edge-factory.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
@@ -12457,7 +12502,7 @@ spec:
         type: Secret
         name: hub-ca
         key: hub-kube-root-ca.crt
-        namespace: imperative
+        namespace: golang-external-secrets
 
       auth:
         kubernetes:
diff --git a/common/tests/golang-external-secrets-industrial-edge-hub.expected.yaml b/common/tests/golang-external-secrets-industrial-edge-hub.expected.yaml
index 0ecbf649..08528096 100644
--- a/common/tests/golang-external-secrets-industrial-edge-hub.expected.yaml
+++ b/common/tests/golang-external-secrets-industrial-edge-hub.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
diff --git a/common/tests/golang-external-secrets-medical-diagnosis-hub.expected.yaml b/common/tests/golang-external-secrets-medical-diagnosis-hub.expected.yaml
index 0ecbf649..08528096 100644
--- a/common/tests/golang-external-secrets-medical-diagnosis-hub.expected.yaml
+++ b/common/tests/golang-external-secrets-medical-diagnosis-hub.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
diff --git a/common/tests/golang-external-secrets-naked.expected.yaml b/common/tests/golang-external-secrets-naked.expected.yaml
index 55750256..c4f6c22f 100644
--- a/common/tests/golang-external-secrets-naked.expected.yaml
+++ b/common/tests/golang-external-secrets-naked.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
diff --git a/common/tests/golang-external-secrets-normal.expected.yaml b/common/tests/golang-external-secrets-normal.expected.yaml
index 0ecbf649..08528096 100644
--- a/common/tests/golang-external-secrets-normal.expected.yaml
+++ b/common/tests/golang-external-secrets-normal.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
diff --git a/common/tests/hashicorp-vault-industrial-edge-factory.expected.yaml b/common/tests/hashicorp-vault-industrial-edge-factory.expected.yaml
index 74212ee2..8156e2af 100644
--- a/common/tests/hashicorp-vault-industrial-edge-factory.expected.yaml
+++ b/common/tests/hashicorp-vault-industrial-edge-factory.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/common/tests/hashicorp-vault-industrial-edge-hub.expected.yaml b/common/tests/hashicorp-vault-industrial-edge-hub.expected.yaml
index 74212ee2..8156e2af 100644
--- a/common/tests/hashicorp-vault-industrial-edge-hub.expected.yaml
+++ b/common/tests/hashicorp-vault-industrial-edge-hub.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/common/tests/hashicorp-vault-medical-diagnosis-hub.expected.yaml b/common/tests/hashicorp-vault-medical-diagnosis-hub.expected.yaml
index 74212ee2..8156e2af 100644
--- a/common/tests/hashicorp-vault-medical-diagnosis-hub.expected.yaml
+++ b/common/tests/hashicorp-vault-medical-diagnosis-hub.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/common/tests/hashicorp-vault-naked.expected.yaml b/common/tests/hashicorp-vault-naked.expected.yaml
index 1fe2cd90..8727ef0e 100644
--- a/common/tests/hashicorp-vault-naked.expected.yaml
+++ b/common/tests/hashicorp-vault-naked.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/common/tests/hashicorp-vault-normal.expected.yaml b/common/tests/hashicorp-vault-normal.expected.yaml
index 74212ee2..8156e2af 100644
--- a/common/tests/hashicorp-vault-normal.expected.yaml
+++ b/common/tests/hashicorp-vault-normal.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/common/tests/operator-install-industrial-edge-factory.expected.yaml b/common/tests/operator-install-industrial-edge-factory.expected.yaml
index 018eb4c5..5e4aa02e 100644
--- a/common/tests/operator-install-industrial-edge-factory.expected.yaml
+++ b/common/tests/operator-install-industrial-edge-factory.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---
diff --git a/common/tests/operator-install-industrial-edge-hub.expected.yaml b/common/tests/operator-install-industrial-edge-hub.expected.yaml
index 018eb4c5..5e4aa02e 100644
--- a/common/tests/operator-install-industrial-edge-hub.expected.yaml
+++ b/common/tests/operator-install-industrial-edge-hub.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---
diff --git a/common/tests/operator-install-medical-diagnosis-hub.expected.yaml b/common/tests/operator-install-medical-diagnosis-hub.expected.yaml
index 018eb4c5..5e4aa02e 100644
--- a/common/tests/operator-install-medical-diagnosis-hub.expected.yaml
+++ b/common/tests/operator-install-medical-diagnosis-hub.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---
diff --git a/common/tests/operator-install-naked.expected.yaml b/common/tests/operator-install-naked.expected.yaml
index fc0d7699..3d58b474 100644
--- a/common/tests/operator-install-naked.expected.yaml
+++ b/common/tests/operator-install-naked.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---
diff --git a/common/tests/operator-install-normal.expected.yaml b/common/tests/operator-install-normal.expected.yaml
index 018eb4c5..5e4aa02e 100644
--- a/common/tests/operator-install-normal.expected.yaml
+++ b/common/tests/operator-install-normal.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---
diff --git a/tests/common-acm-industrial-edge-hub.expected.yaml b/tests/common-acm-industrial-edge-hub.expected.yaml
index 453e8a9e..4199ba03 100644
--- a/tests/common-acm-industrial-edge-hub.expected.yaml
+++ b/tests/common-acm-industrial-edge-hub.expected.yaml
@@ -167,7 +167,7 @@ spec:
                 type: Opaque
                 metadata:
                   name: hub-ca
-                  namespace: imperative
+                  namespace: golang-external-secrets
                 data:
                   hub-kube-root-ca.crt: '{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | base64enc hub}}'
                   hub-openshift-service-ca.crt: '{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | base64enc hub}}'
@@ -214,6 +214,8 @@ spec:
                     path: common/clustergroup
                     helm:
                       ignoreMissingValueFiles: true
+                      values: |
+                        extraParametersNested:
                       valueFiles:
                       - "/values-global.yaml"
                       - "/values-factory.yaml"
diff --git a/tests/common-acm-medical-diagnosis-hub.expected.yaml b/tests/common-acm-medical-diagnosis-hub.expected.yaml
index 8b50de7a..f2a8fdd6 100644
--- a/tests/common-acm-medical-diagnosis-hub.expected.yaml
+++ b/tests/common-acm-medical-diagnosis-hub.expected.yaml
@@ -158,7 +158,7 @@ spec:
                 type: Opaque
                 metadata:
                   name: hub-ca
-                  namespace: imperative
+                  namespace: golang-external-secrets
                 data:
                   hub-kube-root-ca.crt: '{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | base64enc hub}}'
                   hub-openshift-service-ca.crt: '{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | base64enc hub}}'
@@ -205,6 +205,8 @@ spec:
                     path: common/clustergroup
                     helm:
                       ignoreMissingValueFiles: true
+                      values: |
+                        extraParametersNested:
                       valueFiles:
                       - "/values-global.yaml"
                       - "/values-region-one.yaml"
diff --git a/tests/common-acm-normal.expected.yaml b/tests/common-acm-normal.expected.yaml
index 66f1c590..143de18b 100644
--- a/tests/common-acm-normal.expected.yaml
+++ b/tests/common-acm-normal.expected.yaml
@@ -561,7 +561,7 @@ spec:
                 type: Opaque
                 metadata:
                   name: hub-ca
-                  namespace: imperative
+                  namespace: golang-external-secrets
                 data:
                   hub-kube-root-ca.crt: '{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | base64enc hub}}'
                   hub-openshift-service-ca.crt: '{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | base64enc hub}}'
@@ -608,6 +608,8 @@ spec:
                     path: common/clustergroup
                     helm:
                       ignoreMissingValueFiles: true
+                      values: |
+                        extraParametersNested:
                       valueFiles:
                       - "/values-global.yaml"
                       - "/values-acm-edge.yaml"
@@ -704,6 +706,8 @@ spec:
                     path: common/clustergroup
                     helm:
                       ignoreMissingValueFiles: true
+                      values: |
+                        extraParametersNested:
                       valueFiles:
                       - "/values-global.yaml"
                       - "/values-acm-provision-edge.yaml"
diff --git a/tests/common-clustergroup-industrial-edge-factory.expected.yaml b/tests/common-clustergroup-industrial-edge-factory.expected.yaml
index 5de901a2..1826e750 100644
--- a/tests/common-clustergroup-industrial-edge-factory.expected.yaml
+++ b/tests/common-clustergroup-industrial-edge-factory.expected.yaml
@@ -64,6 +64,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -116,6 +123,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -279,11 +289,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -293,12 +316,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -318,6 +359,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: mypattern-factory-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -355,7 +400,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -537,6 +582,8 @@ spec:
     path: charts/datacenter/opendatahub
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-factory.yaml"
diff --git a/tests/common-clustergroup-industrial-edge-hub.expected.yaml b/tests/common-clustergroup-industrial-edge-hub.expected.yaml
index c7777554..b81b7cef 100644
--- a/tests/common-clustergroup-industrial-edge-hub.expected.yaml
+++ b/tests/common-clustergroup-industrial-edge-hub.expected.yaml
@@ -109,6 +109,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -237,6 +244,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -440,11 +450,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -454,12 +477,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -479,6 +520,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: mypattern-datacenter-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -516,7 +561,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -835,6 +880,8 @@ spec:
     path: common/acm
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -900,6 +947,8 @@ spec:
     path: charts/datacenter/opendatahub
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -956,6 +1005,8 @@ spec:
     path: charts/datacenter/pipelines
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -1012,6 +1063,8 @@ spec:
     path: charts/datacenter/manuela-data-lake
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -1098,6 +1151,8 @@ spec:
     path: charts/datacenter/external-secrets
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -1154,6 +1209,8 @@ spec:
     path: common/golang-external-secrets
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
@@ -1237,6 +1294,8 @@ spec:
     chart: vault
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-datacenter.yaml"
diff --git a/tests/common-clustergroup-medical-diagnosis-hub.expected.yaml b/tests/common-clustergroup-medical-diagnosis-hub.expected.yaml
index bcf7c6b0..d6496a85 100644
--- a/tests/common-clustergroup-medical-diagnosis-hub.expected.yaml
+++ b/tests/common-clustergroup-medical-diagnosis-hub.expected.yaml
@@ -109,6 +109,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -220,6 +227,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -367,11 +377,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -381,12 +404,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -406,6 +447,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: mypattern-hub-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -443,7 +488,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -720,6 +765,8 @@ spec:
     path: common/golang-external-secrets
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -776,6 +823,8 @@ spec:
     path: charts/all/kafdrop
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -832,6 +881,8 @@ spec:
     path: charts/all/kafka
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -888,6 +939,8 @@ spec:
     path: charts/all/opendatahub
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -944,6 +997,8 @@ spec:
     path: charts/all/openshift-data-foundations
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1000,6 +1055,8 @@ spec:
     path: charts/all/openshift-serverless
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1056,6 +1113,8 @@ spec:
     path: charts/all/medical-diagnosis/service-account
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1112,6 +1171,8 @@ spec:
     chart: vault
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1186,6 +1247,8 @@ spec:
     path: charts/all/medical-diagnosis/database
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1242,6 +1305,8 @@ spec:
     path: charts/all/medical-diagnosis/grafana
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1298,6 +1363,8 @@ spec:
     path: charts/all/medical-diagnosis/image-generator
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1363,6 +1430,8 @@ spec:
     path: charts/all/medical-diagnosis/image-server
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
@@ -1428,6 +1497,8 @@ spec:
     path: charts/all/medical-diagnosis/xray-init
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-hub.yaml"
diff --git a/tests/common-clustergroup-naked.expected.yaml b/tests/common-clustergroup-naked.expected.yaml
index fdaf4293..a7fee415 100644
--- a/tests/common-clustergroup-naked.expected.yaml
+++ b/tests/common-clustergroup-naked.expected.yaml
@@ -28,6 +28,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -43,6 +50,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -117,11 +127,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -131,12 +154,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -156,6 +197,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: common-example-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -193,7 +238,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/tests/common-clustergroup-normal.expected.yaml b/tests/common-clustergroup-normal.expected.yaml
index 816269ed..2fca5174 100644
--- a/tests/common-clustergroup-normal.expected.yaml
+++ b/tests/common-clustergroup-normal.expected.yaml
@@ -96,6 +96,13 @@ metadata:
   name: imperative-sa
   namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: imperative-admin-sa
+  namespace: imperative
+---
 # Source: clustergroup/templates/imperative/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
@@ -128,6 +135,9 @@ data:
         initContainers: []
       imperative:
         activeDeadlineSeconds: 3600
+        adminClusterRoleName: imperative-admin-cluster-role
+        adminServiceAccountCreate: true
+        adminServiceAccountName: imperative-admin-sa
         clusterRoleName: imperative-cluster-role
         clusterRoleYaml: ""
         cronJobName: imperative-cronjob
@@ -329,11 +339,24 @@ rules:
     - list
     - watch
 ---
+# Source: clustergroup/templates/imperative/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imperative-admin-cluster-role
+rules:
+  - apiGroups:
+    - '*'
+    resources:
+    - '*'
+    verbs:
+    - '*'
+---
 # Source: clustergroup/templates/imperative/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: imperative-cluster-admin-rolebinding
+  name: imperative-cluster-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -343,12 +366,30 @@ subjects:
     name: imperative-sa
     namespace: imperative
 ---
+# Source: clustergroup/templates/imperative/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imperative-admin-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imperative-admin-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: imperative-admin-sa
+    namespace: imperative
+---
 # Source: clustergroup/templates/plumbing/argocd-super-role.yaml
 # WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: openshift-gitops-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -368,6 +409,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: mypattern-example-cluster-admin-rolebinding
+  # We need to have this before anything else or the sync might get stuck forever
+  # due to permission issues
+  annotations:
+    argocd.argoproj.io/sync-wave: "-100"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -405,7 +450,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: imperative-admin-rolebinding
+  name: imperative-rolebinding
   namespace: imperative
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -685,6 +730,8 @@ spec:
     path: common/acm
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-example.yaml"
@@ -752,6 +799,8 @@ spec:
     path: charts/datacenter/pipelines
     helm:
       ignoreMissingValueFiles: true
+      values: |
+        extraParametersNested:
       valueFiles:
       - "/values-global.yaml"
       - "/values-example.yaml"
diff --git a/tests/common-golang-external-secrets-industrial-edge-factory.expected.yaml b/tests/common-golang-external-secrets-industrial-edge-factory.expected.yaml
index dde550fd..2a9621a7 100644
--- a/tests/common-golang-external-secrets-industrial-edge-factory.expected.yaml
+++ b/tests/common-golang-external-secrets-industrial-edge-factory.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: common-golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: common-golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: common-golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
@@ -12457,7 +12502,7 @@ spec:
         type: Secret
         name: hub-ca
         key: hub-kube-root-ca.crt
-        namespace: imperative
+        namespace: golang-external-secrets
 
       auth:
         kubernetes:
diff --git a/tests/common-golang-external-secrets-industrial-edge-hub.expected.yaml b/tests/common-golang-external-secrets-industrial-edge-hub.expected.yaml
index a0ad351a..2f0b9ac3 100644
--- a/tests/common-golang-external-secrets-industrial-edge-hub.expected.yaml
+++ b/tests/common-golang-external-secrets-industrial-edge-hub.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: common-golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: common-golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: common-golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
diff --git a/tests/common-golang-external-secrets-medical-diagnosis-hub.expected.yaml b/tests/common-golang-external-secrets-medical-diagnosis-hub.expected.yaml
index a0ad351a..2f0b9ac3 100644
--- a/tests/common-golang-external-secrets-medical-diagnosis-hub.expected.yaml
+++ b/tests/common-golang-external-secrets-medical-diagnosis-hub.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: common-golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: common-golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: common-golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
diff --git a/tests/common-golang-external-secrets-naked.expected.yaml b/tests/common-golang-external-secrets-naked.expected.yaml
index 3d54dd63..dc6b146d 100644
--- a/tests/common-golang-external-secrets-naked.expected.yaml
+++ b/tests/common-golang-external-secrets-naked.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: common-golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: common-golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: common-golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
diff --git a/tests/common-golang-external-secrets-normal.expected.yaml b/tests/common-golang-external-secrets-normal.expected.yaml
index a0ad351a..2f0b9ac3 100644
--- a/tests/common-golang-external-secrets-normal.expected.yaml
+++ b/tests/common-golang-external-secrets-normal.expected.yaml
@@ -6,10 +6,10 @@ metadata:
   name: external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/serviceaccount.yaml
@@ -19,10 +19,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -32,10 +32,10 @@ metadata:
   name: external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-secret.yaml
@@ -45,10 +45,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 ---
@@ -67,7 +67,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: acraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -263,7 +263,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clusterexternalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -780,11 +780,13 @@ spec:
                             items:
                               type: string
                             type: array
+                            x-kubernetes-list-type: atomic
                         required:
                           - key
                           - operator
                         type: object
                       type: array
+                      x-kubernetes-list-type: atomic
                     matchLabels:
                       additionalProperties:
                         type: string
@@ -827,11 +829,13 @@ spec:
                               items:
                                 type: string
                               type: array
+                              x-kubernetes-list-type: atomic
                           required:
                             - key
                             - operator
                           type: object
                         type: array
+                        x-kubernetes-list-type: atomic
                       matchLabels:
                         additionalProperties:
                           type: string
@@ -844,7 +848,7 @@ spec:
                     x-kubernetes-map-type: atomic
                   type: array
                 namespaces:
-                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelector ends up choosing.
+                  description: Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
                   items:
                     type: string
                   type: array
@@ -916,7 +920,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: clustersecretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -2484,11 +2488,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -2921,6 +2927,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -5079,7 +5102,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: ecrauthorizationtokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -5246,7 +5269,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: externalsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6051,7 +6074,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: fakes.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6127,7 +6150,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: gcraccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6255,7 +6278,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: githubaccesstokens.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6357,7 +6380,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: passwords.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -6455,7 +6478,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: pushsecrets.external-secrets.io
 spec:
   group: external-secrets.io
@@ -6586,11 +6609,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -6831,7 +6856,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: secretstores.external-secrets.io
 spec:
   group: external-secrets.io
@@ -8399,11 +8424,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                  x-kubernetes-list-type: atomic
                               required:
                                 - key
                                 - operator
                               type: object
                             type: array
+                            x-kubernetes-list-type: atomic
                           matchLabels:
                             additionalProperties:
                               type: string
@@ -8836,6 +8863,23 @@ spec:
                         authSecretRef:
                           description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
                           properties:
+                            clientCertificate:
+                              description: The Azure ClientCertificate of the service principle used for authentication.
+                              properties:
+                                key:
+                                  description: |-
+                                    The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
+                                    defaulted, in others it may be required.
+                                  type: string
+                                name:
+                                  description: The name of the Secret resource being referred to.
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
+                                    to the namespace of the referent.
+                                  type: string
+                              type: object
                             clientId:
                               description: The Azure clientId of the service principle or managed identity used for authentication.
                               properties:
@@ -10994,7 +11038,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: vaultdynamicsecrets.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11686,7 +11730,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.15.0
   name: webhooks.generators.external-secrets.io
 spec:
   group: generators.external-secrets.io
@@ -11834,10 +11878,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -11901,10 +11945,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12012,10 +12056,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-view
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
@@ -12054,10 +12098,10 @@ kind: ClusterRole
 metadata:
   name: common-golang-external-secrets-edit
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12100,10 +12144,10 @@ metadata:
   name: common-golang-external-secrets-servicebindings
   labels:
     servicebinding.io/controller: "true"
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12121,10 +12165,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-cert-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12141,10 +12185,10 @@ kind: ClusterRoleBinding
 metadata:
   name: common-golang-external-secrets-controller
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12177,10 +12221,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 rules:
   - apiGroups:
@@ -12216,10 +12260,10 @@ metadata:
   name: common-golang-external-secrets-leaderelection
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12237,10 +12281,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 spec:
@@ -12261,10 +12305,10 @@ metadata:
   name: common-golang-external-secrets-cert-controller
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-cert-controller
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12276,10 +12320,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-cert-controller
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: external-secrets-cert-controller
@@ -12294,7 +12338,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - certcontroller
@@ -12324,10 +12368,10 @@ metadata:
   name: common-golang-external-secrets
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12339,10 +12383,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       serviceAccountName: common-golang-external-secrets
@@ -12357,7 +12401,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - --concurrent=1
@@ -12366,6 +12410,7 @@ spec:
             - containerPort: 8080
               protocol: TCP
               name: metrics
+      dnsPolicy: ClusterFirst
 ---
 # Source: golang-external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
 apiVersion: apps/v1
@@ -12374,10 +12419,10 @@ metadata:
   name: common-golang-external-secrets-webhook
   namespace: default
   labels:
-    helm.sh/chart: external-secrets-0.9.16
+    helm.sh/chart: external-secrets-0.9.18
     app.kubernetes.io/name: external-secrets-webhook
     app.kubernetes.io/instance: common-golang-external-secrets
-    app.kubernetes.io/version: "v0.9.16"
+    app.kubernetes.io/version: "v0.9.18"
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 1
@@ -12389,10 +12434,10 @@ spec:
   template:
     metadata:
       labels:
-        helm.sh/chart: external-secrets-0.9.16
+        helm.sh/chart: external-secrets-0.9.18
         app.kubernetes.io/name: external-secrets-webhook
         app.kubernetes.io/instance: common-golang-external-secrets
-        app.kubernetes.io/version: "v0.9.16"
+        app.kubernetes.io/version: "v0.9.18"
         app.kubernetes.io/managed-by: Helm
     spec:
       hostNetwork: false
@@ -12407,7 +12452,7 @@ spec:
               - ALL
             readOnlyRootFilesystem: true
             runAsNonRoot: true
-          image: ghcr.io/external-secrets/external-secrets:v0.9.16-ubi
+          image: ghcr.io/external-secrets/external-secrets:v0.9.18-ubi
           imagePullPolicy: IfNotPresent
           args:
           - webhook
diff --git a/tests/common-hashicorp-vault-industrial-edge-factory.expected.yaml b/tests/common-hashicorp-vault-industrial-edge-factory.expected.yaml
index 9838c4a7..62eadc16 100644
--- a/tests/common-hashicorp-vault-industrial-edge-factory.expected.yaml
+++ b/tests/common-hashicorp-vault-industrial-edge-factory.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: common-hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/tests/common-hashicorp-vault-industrial-edge-hub.expected.yaml b/tests/common-hashicorp-vault-industrial-edge-hub.expected.yaml
index 9838c4a7..62eadc16 100644
--- a/tests/common-hashicorp-vault-industrial-edge-hub.expected.yaml
+++ b/tests/common-hashicorp-vault-industrial-edge-hub.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: common-hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/tests/common-hashicorp-vault-medical-diagnosis-hub.expected.yaml b/tests/common-hashicorp-vault-medical-diagnosis-hub.expected.yaml
index 9838c4a7..62eadc16 100644
--- a/tests/common-hashicorp-vault-medical-diagnosis-hub.expected.yaml
+++ b/tests/common-hashicorp-vault-medical-diagnosis-hub.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: common-hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/tests/common-hashicorp-vault-naked.expected.yaml b/tests/common-hashicorp-vault-naked.expected.yaml
index e6933c44..16eadf00 100644
--- a/tests/common-hashicorp-vault-naked.expected.yaml
+++ b/tests/common-hashicorp-vault-naked.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: common-hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/tests/common-hashicorp-vault-normal.expected.yaml b/tests/common-hashicorp-vault-normal.expected.yaml
index 9838c4a7..62eadc16 100644
--- a/tests/common-hashicorp-vault-normal.expected.yaml
+++ b/tests/common-hashicorp-vault-normal.expected.yaml
@@ -206,7 +206,7 @@ spec:
       containers:
         - name: vault
           
-          image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+          image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
           imagePullPolicy: IfNotPresent
           command:
           - "/bin/sh"
@@ -375,7 +375,7 @@ spec:
   
   containers:
     - name: common-hashicorp-vault-server-test
-      image: registry.connect.redhat.com/hashicorp/vault:1.16.1-ubi
+      image: registry.connect.redhat.com/hashicorp/vault:1.16.2-ubi
       imagePullPolicy: IfNotPresent
       env:
         - name: VAULT_ADDR
diff --git a/tests/common-operator-install-industrial-edge-factory.expected.yaml b/tests/common-operator-install-industrial-edge-factory.expected.yaml
index b04d071e..755b244f 100644
--- a/tests/common-operator-install-industrial-edge-factory.expected.yaml
+++ b/tests/common-operator-install-industrial-edge-factory.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---
diff --git a/tests/common-operator-install-industrial-edge-hub.expected.yaml b/tests/common-operator-install-industrial-edge-hub.expected.yaml
index b04d071e..755b244f 100644
--- a/tests/common-operator-install-industrial-edge-hub.expected.yaml
+++ b/tests/common-operator-install-industrial-edge-hub.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---
diff --git a/tests/common-operator-install-medical-diagnosis-hub.expected.yaml b/tests/common-operator-install-medical-diagnosis-hub.expected.yaml
index b04d071e..755b244f 100644
--- a/tests/common-operator-install-medical-diagnosis-hub.expected.yaml
+++ b/tests/common-operator-install-medical-diagnosis-hub.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---
diff --git a/tests/common-operator-install-naked.expected.yaml b/tests/common-operator-install-naked.expected.yaml
index ada9ab18..937fb6a2 100644
--- a/tests/common-operator-install-naked.expected.yaml
+++ b/tests/common-operator-install-naked.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---
diff --git a/tests/common-operator-install-normal.expected.yaml b/tests/common-operator-install-normal.expected.yaml
index b04d071e..755b244f 100644
--- a/tests/common-operator-install-normal.expected.yaml
+++ b/tests/common-operator-install-normal.expected.yaml
@@ -25,9 +25,6 @@ spec:
   gitSpec:
     targetRepo: https://github.com/pattern-clone/mypattern
     targetRevision: main 
-  gitOpsSpec:
-    operatorChannel: gitops-1.12
-    operatorSource: redhat-operators
   multiSourceConfig:
     enabled: false
 ---