diff --git a/addons/clickhouse/24/chart/clickhouse/README.md b/addons/clickhouse/24/chart/clickhouse/README.md
index caba5167..95466d70 100644
--- a/addons/clickhouse/24/chart/clickhouse/README.md
+++ b/addons/clickhouse/24/chart/clickhouse/README.md
@@ -475,4 +475,7 @@ Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
-limitations under the License.
\ No newline at end of file
+limitations under the License.
+
+
+https://github.com/ClickHouse/ClickHouse/pull/62366/
\ No newline at end of file
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/_helpers.tpl b/addons/clickhouse/24/chart/clickhouse/templates/_helpers.tpl
index 5d3b9dca..64055c41 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/_helpers.tpl
+++ b/addons/clickhouse/24/chart/clickhouse/templates/_helpers.tpl
@@ -1,3 +1,8 @@
+{{/*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{/*
 Return the proper ClickHouse image name
 */}}
@@ -94,6 +99,18 @@ Get the ClickHouse configuration configmap.
 {{- end -}}
 {{- end -}}
 
+
+{{/*
+Get the ClickHouse configuration users configmap.
+*/}}
+{{- define "clickhouse.usersExtraConfigmapName" -}}
+{{- if .Values.usersExtraOverridesConfigmap -}}
+    {{- .Values.usersExtraOverridesConfigmap -}}
+{{- else }}
+    {{- printf "%s-users-extra" (include "common.names.fullname" . ) -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Get the Clickhouse password secret name
 */}}
@@ -185,17 +202,18 @@ Compile all warnings into a single message.
 {{- end -}}
 {{- end -}}
 
-{{/* Validate values of ClickHouse - Zookeeper */}}
+{{/* Validate values of ClickHouse - [Zoo]keeper */}}
 {{- define "clickhouse.validateValues.zookeeper" -}}
-{{- if and .Values.zookeeper.enabled .Values.externalZookeeper.servers -}}
-clickhouse: Multiple Zookeeper
-    You can only use one zookeeper
-    Please choose installing a Zookeeper chart (--set zookeeper.enabled=true) or
+{{- if or (and .Values.keeper.enabled .Values.zookeeper.enabled) (and .Values.keeper.enabled .Values.externalZookeeper.servers) (and .Values.zookeeper.enabled .Values.externalZookeeper.servers) -}}
+clickhouse: Multiple [Zoo]keeper
+    You can only use one [zoo]keeper
+    Please choose use ClickHouse keeper or
+    installing a Zookeeper chart (--set zookeeper.enabled=true) or
     using an external instance (--set zookeeper.servers )
 {{- end -}}
-{{- if and (not .Values.zookeeper.enabled) (not .Values.externalZookeeper.servers) (ne (int .Values.shards) 1) (ne (int .Values.replicaCount) 1) -}}
-clickhouse: No Zookeeper
-    If you are deploying more than one ClickHouse instance, you need to enable Zookeeper. Please choose installing a Zookeeper chart (--set zookeeper.enabled=true) or
+{{- if and (not .Values.keeper.enabled) (not .Values.zookeeper.enabled) (not .Values.externalZookeeper.servers) (ne (int .Values.shards) 1) (ne (int .Values.replicaCount) 1) -}}
+clickhouse: No [Zoo]keeper
+    If you are deploying more than one ClickHouse instance, you need to enable [Zoo]keeper. Please choose installing a [Zoo]keeper (--set keeper.enabled=true) or (--set zookeeper.enabled=true) or
     using an external instance (--set zookeeper.servers )
 {{- end -}}
 {{- end -}}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/configmap-extra.yaml b/addons/clickhouse/24/chart/clickhouse/templates/configmap-extra.yaml
index f78a3aef..e0bffcd6 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/configmap-extra.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/configmap-extra.yaml
@@ -1,14 +1,16 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if and .Values.extraOverrides (not .Values.extraOverridesConfigmap) }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ printf "%s-extra" (include "common.names.fullname" .) }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/configmap-users-extra.yaml b/addons/clickhouse/24/chart/clickhouse/templates/configmap-users-extra.yaml
new file mode 100644
index 00000000..bd408b79
--- /dev/null
+++ b/addons/clickhouse/24/chart/clickhouse/templates/configmap-users-extra.yaml
@@ -0,0 +1,20 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.usersExtraOverrides (not .Values.usersExtraOverridesConfigmap) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-users-extra" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: clickhouse
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  01_users_extra_overrides.xml: |
+    {{- include "common.tplvalues.render" (dict "value" .Values.usersExtraOverrides "context" $) | nindent 4 }}
+{{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/configmap.yaml b/addons/clickhouse/24/chart/clickhouse/templates/configmap.yaml
index 2a427dca..49cf3e33 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/configmap.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/configmap.yaml
@@ -1,14 +1,16 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if not .Values.existingOverridesConfigmap }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ template "common.names.fullname" . }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/extra-list.yaml b/addons/clickhouse/24/chart/clickhouse/templates/extra-list.yaml
index 9ac65f9e..329f5c65 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/extra-list.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/extra-list.yaml
@@ -1,3 +1,8 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- range .Values.extraDeploy }}
 ---
 {{ include "common.tplvalues.render" (dict "value" . "context" $) }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/ingress-tls-secrets.yaml b/addons/clickhouse/24/chart/clickhouse/templates/ingress-tls-secrets.yaml
index cdab66cf..27c438cd 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/ingress-tls-secrets.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/ingress-tls-secrets.yaml
@@ -1,3 +1,8 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if .Values.ingress.enabled }}
 {{- if .Values.ingress.secrets }}
 {{- range .Values.ingress.secrets }}
@@ -6,12 +11,9 @@ kind: Secret
 metadata:
   name: {{ .name }}
   namespace: {{ $.Release.Namespace | quote }}
-  labels: {{- include "common.labels.standard" $ | nindent 4 }}
-    {{- if $.Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
   {{- if $.Values.commonAnnotations }}
-  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
 data:
@@ -21,24 +23,22 @@ data:
 {{- end }}
 {{- end }}
 {{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
+{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
 {{- $ca := genCA "clickhouse-ca" 365 }}
 {{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ printf "%s-tls" .Values.ingress.hostname }}
+  name: {{ $secretName }}
   namespace: {{ .Release.Namespace | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
 data:
-  tls.crt: {{ $cert.Cert | b64enc | quote }}
-  tls.key: {{ $cert.Key | b64enc | quote }}
-  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
+  tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
+  ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
 {{- end }}
 {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/ingress.yaml b/addons/clickhouse/24/chart/clickhouse/templates/ingress.yaml
old mode 100755
new mode 100644
index fa1b8db2..dbe543fa
--- a/addons/clickhouse/24/chart/clickhouse/templates/ingress.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/ingress.yaml
@@ -1,20 +1,19 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if .Values.ingress.enabled }}
 apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
 kind: Ingress
 metadata:
   name: {{ include "common.names.fullname" . }}
   namespace: {{ .Release.Namespace | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
-  annotations:
-    {{- if .Values.ingress.annotations }}
-    {{- include "common.tplvalues.render" (dict "value" .Values.ingress.annotations "context" $) | nindent 4 }}
-    {{- end }}
-    {{- if .Values.commonAnnotations }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
-    {{- end }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if or .Values.ingress.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
 spec:
   {{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
   ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/init-scripts-secret.yaml b/addons/clickhouse/24/chart/clickhouse/templates/init-scripts-secret.yaml
index 96f83f61..f5b32fc0 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/init-scripts-secret.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/init-scripts-secret.yaml
@@ -1,14 +1,16 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if and .Values.initdbScripts (not .Values.initdbScriptsSecret) }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: {{ printf "%s-init-scripts" (include "common.names.fullname" .) }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/networkpolicy.yaml b/addons/clickhouse/24/chart/clickhouse/templates/networkpolicy.yaml
new file mode 100644
index 00000000..92cef548
--- /dev/null
+++ b/addons/clickhouse/24/chart/clickhouse/templates/networkpolicy.yaml
@@ -0,0 +1,135 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.networkPolicy.enabled }}
+kind: NetworkPolicy
+apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: clickhouse
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
+  podSelector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: clickhouse
+  policyTypes:
+    - Ingress
+    - Egress
+  {{- if .Values.networkPolicy.allowExternalEgress }}
+  egress:
+    - {}
+  {{- else }}
+  egress:
+    # Allow dns resolution
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # Allow outbound connections to other cluster pods
+    - ports:
+        - port: {{ .Values.service.ports.http }}
+        {{- if .Values.tls.enabled }}
+        - port: {{ .Values.service.ports.https }}
+        {{- end }}
+        - port: {{ .Values.service.ports.tcp }}
+        {{- if .Values.tls.enabled }}
+        - port: {{ .Values.service.ports.tcpSecure }}
+        {{- end }}
+        {{- if .Values.keeper.enabled }}
+        - port: {{ .Values.service.ports.keeper }}
+        - port: {{ .Values.service.ports.keeperInter }}
+        {{- if .Values.tls.enabled }}
+        - port: {{ .Values.service.ports.keeperSecure }}
+        {{- end }}
+        {{- end }}
+        - port: {{ .Values.service.ports.mysql }}
+        - port: {{ .Values.service.ports.postgresql }}
+        - port: {{ .Values.service.ports.interserver }}
+        {{- if .Values.metrics.enabled }}
+        - port: {{ .Values.service.ports.metrics }}
+        {{- end }}
+      {{- if $.Values.externalAccess.enabled }}
+        - port: {{ $.Values.externalAccess.service.ports.http }}
+        {{- if $.Values.tls.enabled }}
+        - port: {{ $.Values.externalAccess.service.ports.https }}
+        {{- end }}
+        {{- if $.Values.metrics.enabled }}
+        - port: {{ $.Values.externalAccess.service.ports.metrics }}
+        {{- end }}
+        - port: {{ $.Values.externalAccess.service.ports.tcp }}
+        {{- if $.Values.tls.enabled }}
+        - port: {{ $.Values.externalAccess.service.ports.tcpSecure }}
+        {{- end }}
+        {{- if $.Values.keeper.enabled }}
+        - port: {{ $.Values.externalAccess.service.ports.keeper }}
+        - port: {{ $.Values.externalAccess.service.ports.keeperInter }}
+        {{- if $.Values.tls.enabled }}
+        - port: {{ $.Values.externalAccess.service.ports.keeperSecure }}
+        {{- end }}
+        {{- end }}
+        - port: {{ $.Values.externalAccess.service.ports.mysql }}
+        - port: {{ $.Values.externalAccess.service.ports.postgresql }}
+        - port: {{ $.Values.externalAccess.service.ports.interserver }}
+      {{- end }}
+      to:
+        - podSelector:
+            matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
+    {{- if .Values.networkPolicy.extraEgress }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  {{- if eq $.Values.service.type "ClusterIP" }}
+  ingress:
+    - ports:
+        - port: {{ $.Values.containerPorts.http }}
+        - port: {{ $.Values.containerPorts.tcp }}
+        - port: {{ $.Values.containerPorts.mysql }}
+        - port: {{ $.Values.containerPorts.postgresql }}
+        - port: {{ $.Values.containerPorts.interserver }}
+        {{- if $.Values.tls.enabled }}
+        - port: {{ $.Values.containerPorts.tcpSecure }}
+        - port: {{ $.Values.containerPorts.https }}
+        {{- end }}
+        {{- if $.Values.keeper.enabled }}
+        - port: {{ $.Values.containerPorts.keeper }}
+        - port: {{ $.Values.containerPorts.keeperInter }}
+        {{- if $.Values.tls.enabled }}
+        - port : {{ $.Values.containerPorts.keeperSecure }}
+        {{- end }}
+        {{- end }}
+        {{- if $.Values.metrics.enabled }}
+        - port: {{ $.Values.containerPorts.metrics }}
+        {{- end }}
+     
+      {{- if or .Values.networkPolicy.allowCurrentNamespace .Values.networkPolicy.allowNamespaces }}
+      from:
+      {{- if .Values.networkPolicy.allowCurrentNamespace }}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Release.Namespace }}
+      {{- end }}
+      {{- range $namespace := .Values.networkPolicy.allowNamespaces }}
+        {{- if $namespace }}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ $namespace }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
+    {{- if .Values.networkPolicy.extraIngress }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  {{- if eq $.Values.service.type "LoadBalancer" }}
+  ingress:
+    - {}
+  {{- end }}
+{{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/pdb.yaml b/addons/clickhouse/24/chart/clickhouse/templates/pdb.yaml
new file mode 100644
index 00000000..b8de1224
--- /dev/null
+++ b/addons/clickhouse/24/chart/clickhouse/templates/pdb.yaml
@@ -0,0 +1,34 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.pdb.create }}
+{{- $shards := .Values.shards | int }}
+{{- range $i, $e := until $shards }}
+apiVersion: {{ include "common.capabilities.policy.apiVersion" $ }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ printf "%s-shard%d" (include "common.names.fullname" $ ) $i }}
+  namespace: {{ include "common.names.namespace" $ | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: clickhouse
+    shard: {{ $i | quote }}
+  {{- if $.Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if $.Values.pdb.minAvailable }}
+  minAvailable: {{ $.Values.pdb.minAvailable }}
+  {{- end  }}
+  {{- if or $.Values.pdb.maxUnavailable (not $.Values.pdb.minAvailable) }}
+  maxUnavailable: {{ $.Values.pdb.maxUnavailable | default 1 }}
+  {{- end  }}
+  {{- $podLabels := include "common.tplvalues.merge" (dict "values" (list $.Values.podLabels $.Values.commonLabels) "context" $) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: clickhouse
+      shard: {{ $i | quote }}
+---
+{{- end }}
+{{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/prometheusrule.yaml b/addons/clickhouse/24/chart/clickhouse/templates/prometheusrule.yaml
new file mode 100644
index 00000000..5e499111
--- /dev/null
+++ b/addons/clickhouse/24/chart/clickhouse/templates/prometheusrule.yaml
@@ -0,0 +1,24 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled .Values.metrics.prometheusRule.rules }}
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  namespace: {{ default .Release.Namespace .Values.metrics.prometheusRule.namespace | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: metrics
+    {{- if .Values.metrics.prometheusRule.additionalLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $ ) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  groups:
+    - name: {{ include "common.names.fullname" . }}
+      rules: {{- toYaml .Values.metrics.prometheusRule.rules | nindent 8 }}
+{{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/scripts-configmap.yaml b/addons/clickhouse/24/chart/clickhouse/templates/scripts-configmap.yaml
new file mode 100644
index 00000000..80e64e8a
--- /dev/null
+++ b/addons/clickhouse/24/chart/clickhouse/templates/scripts-configmap.yaml
@@ -0,0 +1,34 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-scripts" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: clickhouse
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  setup.sh: |-
+    #!/bin/bash
+
+    # Execute entrypoint as usual after obtaining KEEPER_SERVER_ID
+    # check KEEPER_SERVER_ID in persistent volume via myid
+    # if not present, set based on POD hostname
+    if [[ -f "/drycc/clickhouse/keeper/data/myid" ]]; then
+        export KEEPER_SERVER_ID="$(cat /drycc/clickhouse/keeper/data/myid)"
+    else
+        HOSTNAME="$(hostname -s)"
+        if [[ $HOSTNAME =~ (.*)-([0-9]+)$ ]]; then
+            export KEEPER_SERVER_ID=${BASH_REMATCH[2]}
+        else
+            echo "Failed to get index from hostname $HOST"
+            exit 1
+        fi
+    fi
+    exec /opt/drycc/scripts/clickhouse/entrypoint.sh /opt/drycc/scripts/clickhouse/run.sh -- --listen_host=0.0.0.0
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/secret.yaml b/addons/clickhouse/24/chart/clickhouse/templates/secret.yaml
index 89f58cee..7a1f961f 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/secret.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/secret.yaml
@@ -1,14 +1,16 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if not .Values.auth.existingSecret }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: {{ template "common.names.fullname" . }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/service-account.yaml b/addons/clickhouse/24/chart/clickhouse/templates/service-account.yaml
index b3787391..58c3eeed 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/service-account.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/service-account.yaml
@@ -1,22 +1,19 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if .Values.serviceAccount.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "clickhouse.serviceAccountName" . }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
   {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
-  annotations:
-    {{- if .Values.commonAnnotations }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
-    {{- end }}
-    {{- if .Values.serviceAccount.annotations }}
-    {{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.annotations "context" $) | nindent 4 }}
-    {{- end }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
   {{- end }}
 automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/service-external-access.yaml b/addons/clickhouse/24/chart/clickhouse/templates/service-external-access.yaml
index 2af4abb2..5393a531 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/service-external-access.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/service-external-access.yaml
@@ -1,28 +1,30 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if $.Values.externalAccess.enabled }}
 {{- $shards := $.Values.shards | int }}
 {{- $replicas := $.Values.replicaCount | int }}
 {{- $totalNodes := mul $shards $replicas }}
 {{- range $shard, $e := until $shards }}
 {{- range $i, $_e := until $replicas }}
+{{- $loadBalancerAnnotationPosOffset := mul $shard $replicas }}
+{{- $loadBalancerAnnotationPosition := add $loadBalancerAnnotationPosOffset $i }}
 {{- $targetPod := printf "%s-shard%d-%d" (include "common.names.fullname" $) $shard $i }}
 apiVersion: v1
 kind: Service
 metadata:
   name: {{ printf "%s-external" $targetPod | trunc 63 | trimSuffix "-" }}
   namespace: {{ $.Release.Namespace | quote }}
-  labels: {{- include "common.labels.standard" $ | nindent 4 }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list $.Values.externalAccess.service.labels $.Values.commonLabels ) "context" $ ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
     pod: {{ $targetPod }}
-    {{- if $.Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
-    {{- if $.Values.externalAccess.service.labels }}
-    {{- include "common.tplvalues.render" ( dict "value" $.Values.externalAccess.service.labels "context" $) | nindent 4 }}
-    {{- end }}
   {{- if or $.Values.externalAccess.service.annotations $.Values.commonAnnotations $.Values.externalAccess.service.loadBalancerAnnotations }}
   annotations:
     {{- if and (not (empty $.Values.externalAccess.service.loadBalancerAnnotations)) (eq (len $.Values.externalAccess.service.loadBalancerAnnotations) $totalNodes) }}
-    {{ include "common.tplvalues.render" ( dict "value" (index $.Values.externalAccess.service.loadBalancerAnnotations $i) "context" $) | nindent 4 }}
+    {{ include "common.tplvalues.render" ( dict "value" (index $.Values.externalAccess.service.loadBalancerAnnotations $loadBalancerAnnotationPosition) "context" $) | nindent 4 }}
     {{- end }}
     {{- if $.Values.externalAccess.service.annotations }}
     {{- include "common.tplvalues.render" ( dict "value" $.Values.externalAccess.service.annotations "context" $) | nindent 4 }}
@@ -50,6 +52,16 @@ spec:
       {{- else }}
       nodePort: null
       {{- end }}
+    {{- if $.Values.tls.enabled }}
+    - name: https
+      port: {{ $.Values.externalAccess.service.ports.https }}
+      targetPort: https
+      {{- if not (empty $.Values.externalAccess.service.nodePorts.https) }}
+      nodePort: {{ index $.Values.externalAccess.service.nodePorts.https $i }}
+      {{- else }}
+      nodePort: null
+      {{- end }}
+    {{- end }}
     {{- if $.Values.metrics.enabled }}
     - name: http-metrics
       port: {{ $.Values.externalAccess.service.ports.metrics }}
@@ -78,6 +90,34 @@ spec:
       nodePort: null
       {{- end }}
     {{- end }}
+    {{- if $.Values.keeper.enabled }}
+    - name: tcp-keeper
+      port: {{ $.Values.externalAccess.service.ports.keeper }}
+      targetPort: tcp-keeper
+      {{- if not (empty $.Values.externalAccess.service.nodePorts.keeper) }}
+      nodePort: {{ index $.Values.externalAccess.service.nodePorts.keeper $i }}
+      {{- else }}
+      nodePort: null
+      {{- end }}
+    - name: tcp-keeperinter
+      port: {{ $.Values.externalAccess.service.ports.keeperInter }}
+      targetPort: tcp-keeperinter
+      {{- if not (empty $.Values.externalAccess.service.nodePorts.keeperInter) }}
+      nodePort: {{ index $.Values.externalAccess.service.nodePorts.keeperInter $i }}
+      {{- else }}
+      nodePort: null
+      {{- end }}
+    {{- if $.Values.tls.enabled }}
+    - name: tcp-keepertls
+      port: {{ $.Values.externalAccess.service.ports.keeperSecure }}
+      targetPort: tcp-keepertls
+      {{- if not (empty $.Values.externalAccess.service.nodePorts.keeperSecure) }}
+      nodePort: {{ index $.Values.externalAccess.service.nodePorts.keeperSecure $i }}
+      {{- else }}
+      nodePort: null
+      {{- end }}
+    {{- end }}
+    {{- end }}
     - name: tcp-mysql
       port: {{ $.Values.externalAccess.service.ports.mysql }}
       targetPort: tcp-mysql
@@ -105,7 +145,8 @@ spec:
     {{- if $.Values.externalAccess.service.extraPorts }}
     {{- include "common.tplvalues.render" (dict "value" $.Values.externalAccess.service.extraPorts "context" $) | nindent 4 }}
     {{- end }}
-  selector: {{- include "common.labels.matchLabels" $ | nindent 4 }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list $.Values.podLabels $.Values.commonLabels ) "context" $ ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
     statefulset.kubernetes.io/pod-name: {{ $targetPod }}
 ---
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/service-headless.yaml b/addons/clickhouse/24/chart/clickhouse/templates/service-headless.yaml
index 33f86ce1..23d4496a 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/service-headless.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/service-headless.yaml
@@ -1,21 +1,18 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "clickhouse.headlessServiceName" . }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
-  {{- if or .Values.service.annotations .Values.commonAnnotations }}
-  annotations:
-    {{- if .Values.service.annotations }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.service.annotations "context" $) | nindent 4 }}
-    {{- end }}
-    {{- if .Values.commonAnnotations }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
-    {{- end }}
+  {{- if or .Values.service.headless.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
   {{- end }}
 spec:
   type: ClusterIP
@@ -24,32 +21,49 @@ spec:
   ports:
     - name: http
       targetPort: http
-      port: {{ .Values.service.ports.http }}
+      port: {{ .Values.containerPorts.http }}
       protocol: TCP
     - name: tcp
       targetPort: tcp
-      port: {{ .Values.service.ports.tcp }}
+      port: {{ .Values.containerPorts.tcp }}
       protocol: TCP
     {{- if .Values.tls.enabled }}
     - name: tcp-secure
       targetPort: tcp-secure
-      port: {{ .Values.service.ports.tcpSecure }}
+      port: {{ .Values.containerPorts.tcpSecure }}
+      protocol: TCP
+    {{- end }}
+    {{- if .Values.keeper.enabled }}
+    - name: tcp-keeper
+      targetPort: tcp-keeper
+      port: {{ .Values.containerPorts.keeper }}
       protocol: TCP
+    - name: tcp-keeperinter
+      targetPort: tcp-keeperinter
+      port: {{ .Values.containerPorts.keeperInter }}
+      protocol: TCP
+    {{- if .Values.tls.enabled }}
+    - name: tcp-keepertls
+      targetPort: tcp-keepertls
+      port: {{ .Values.containerPorts.keeperSecure }}
+      protocol: TCP
+    {{- end }}
     {{- end }}
-    - name: mysql
-      targetPort: mysql
-      port: {{ .Values.service.ports.mysql }}
+    - name: tcp-mysql
+      targetPort: tcp-mysql
+      port: {{ .Values.containerPorts.mysql }}
       protocol: TCP
     - name: tcp-postgresql
       targetPort: tcp-postgresql
-      port: {{ .Values.service.ports.postgresql }}
+      port: {{ .Values.containerPorts.postgresql }}
       protocol: TCP
     - name: http-intersrv
       targetPort: http-intersrv
-      port: {{ .Values.service.ports.interserver }}
+      port: {{ .Values.containerPorts.interserver }}
       protocol: TCP
     {{- if .Values.service.extraPorts }}
     {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
     {{- end }}
-  selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/service.yaml b/addons/clickhouse/24/chart/clickhouse/templates/service.yaml
index fe2dfc60..3d3f3d7c 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/service.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/service.yaml
@@ -1,21 +1,18 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 apiVersion: v1
 kind: Service
 metadata:
   name: {{ template "common.names.fullname" . }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
   {{- if or .Values.service.annotations .Values.commonAnnotations }}
-  annotations:
-    {{- if .Values.service.annotations }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.service.annotations "context" $) | nindent 4 }}
-    {{- end }}
-    {{- if .Values.commonAnnotations }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
-    {{- end }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
   {{- end }}
 spec:
   type: {{ .Values.service.type }}
@@ -32,7 +29,7 @@ spec:
   externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
   {{- end }}
   {{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerSourceRanges)) }}
-  loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }}
   {{- end }}
   {{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }}
   loadBalancerIP: {{ .Values.service.loadBalancerIP }}
@@ -47,6 +44,17 @@ spec:
       {{- else if eq .Values.service.type "ClusterIP" }}
       nodePort: null
       {{- end }}
+    {{- if .Values.tls.enabled }}
+    - name: https
+      targetPort: https
+      port: {{ .Values.service.ports.https }}
+      protocol: TCP
+      {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.https)) }}
+      nodePort: {{ .Values.service.nodePorts.https }}
+      {{- else if eq .Values.service.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    {{- end }}
     - name: tcp
       targetPort: tcp
       port: {{ .Values.service.ports.tcp }}
@@ -67,6 +75,37 @@ spec:
       nodePort: null
       {{- end }}
     {{- end }}
+    {{- if .Values.keeper.enabled }}
+    - name: tcp-keeper
+      targetPort: tcp-keeper
+      port: {{ .Values.service.ports.keeper }}
+      protocol: TCP
+      {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.tcp)) }}
+      nodePort: {{ .Values.service.nodePorts.keeper }}
+      {{- else if eq .Values.service.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    - name: tcp-keeperinter
+      targetPort: tcp-keeperinter
+      port: {{ .Values.service.ports.keeperInter }}
+      protocol: TCP
+      {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.tcp)) }}
+      nodePort: {{ .Values.service.nodePorts.keeperInter }}
+      {{- else if eq .Values.service.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    {{- if .Values.tls.enabled }}
+    - name: tcp-keepertls
+      targetPort: tcp-keepertls
+      port: {{ .Values.service.ports.keeperSecure }}
+      protocol: TCP
+      {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.tcpSecure)) }}
+      nodePort: {{ .Values.service.nodePorts.keeperSecure }}
+      {{- else if eq .Values.service.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    {{- end }}
+    {{- end }}
     - name: tcp-mysql
       targetPort: tcp-mysql
       port: {{ .Values.service.ports.mysql }}
@@ -108,5 +147,6 @@ spec:
     {{- if .Values.service.extraPorts }}
     {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
     {{- end }}
-  selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/servicemonitor.yaml b/addons/clickhouse/24/chart/clickhouse/templates/servicemonitor.yaml
index 8477fc6e..7e611255 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/servicemonitor.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/servicemonitor.yaml
@@ -1,27 +1,25 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "common.names.fullname" . }}
   namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
-    {{- if .Values.metrics.serviceMonitor.labels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.labels "context" $ ) | nindent 4 }}
-    {{- end }}
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
-  annotations:
-    {{- if .Values.commonAnnotations }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
-    {{- end }}
-    {{- if .Values.metrics.serviceMonitor.annotations }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.annotations "context" $ ) | nindent 4 }}
-    {{- end }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: clickhouse
+  {{- if or .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
 spec:
   jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel | quote }}
   selector:
-    matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
       {{- if .Values.metrics.serviceMonitor.selector }}
       {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
       {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/start-scripts-secret.yaml b/addons/clickhouse/24/chart/clickhouse/templates/start-scripts-secret.yaml
index 0239d702..a35a1648 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/start-scripts-secret.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/start-scripts-secret.yaml
@@ -1,14 +1,16 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if and .Values.startdbScripts (not .Values.startdbScriptsSecret) }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: {{ printf "%s-start-scripts" (include "common.names.fullname" .) }}
   namespace: {{ include "common.names.namespace" . | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/statefulset.yaml b/addons/clickhouse/24/chart/clickhouse/templates/statefulset.yaml
index 3c4ffa7a..2e1071c5 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/statefulset.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/statefulset.yaml
@@ -1,23 +1,32 @@
-{{- $replicas := .Values.shards | int }}
-{{- range $i, $e := until $replicas }}
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- $shards := .Values.shards | int }}
+{{- range $i, $e := until $shards }}
 apiVersion: {{ include "common.capabilities.statefulset.apiVersion" $ }}
 kind: StatefulSet
 metadata:
   name: {{ printf "%s-shard%d" (include "common.names.fullname" $ ) $i }}
   namespace: {{ include "common.names.namespace" $ | quote }}
-  labels: {{- include "common.labels.standard" $ | nindent 4 }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
     app.kubernetes.io/component: clickhouse
-    {{- if $.Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
+    shard: {{ $i | quote }}
   {{- if $.Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
 spec:
+  {{- if $.Values.persistentVolumeClaimRetentionPolicy.enabled }}
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: {{ $.Values.persistentVolumeClaimRetentionPolicy.whenDeleted }}
+    whenScaled: {{ $.Values.persistentVolumeClaimRetentionPolicy.whenScaled }}
+  {{- end }}
   replicas: {{ $.Values.replicaCount }}
   podManagementPolicy: {{ $.Values.podManagementPolicy | quote }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list $.Values.podLabels $.Values.commonLabels ) "context" $ ) }}
   selector:
-    matchLabels: {{ include "common.labels.matchLabels" $ | nindent 6 }}
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
       app.kubernetes.io/component: clickhouse
   serviceName: {{ printf "%s-headless" (include "common.names.fullname" $) }}
   {{- if $.Values.updateStrategy }}
@@ -25,23 +34,23 @@ spec:
   {{- end }}
   template:
     metadata:
-      {{- if or $.Values.podAnnotations (and $.Values.metrics.enabled $.Values.metrics.podAnnotations) }}
       annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") $ | sha256sum }}
+        checksum/config-extra: {{ include (print $.Template.BasePath "/configmap-extra.yaml") $ | sha256sum }}
+        checksum/config-users-extra: {{ include (print $.Template.BasePath "/configmap-users-extra.yaml") $ | sha256sum }}
         {{- if $.Values.podAnnotations }}
         {{- include "common.tplvalues.render" (dict "value" $.Values.podAnnotations "context" $) | nindent 8 }}
         {{- end }}
         {{- if and $.Values.metrics.enabled $.Values.metrics.podAnnotations }}
         {{- include "common.tplvalues.render" (dict "value" $.Values.metrics.podAnnotations "context" $) | nindent 8 }}
         {{- end }}
-      {{- end }}
-      labels: {{- include "common.labels.standard" $ | nindent 8 }}
+      labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
         app.kubernetes.io/component: clickhouse
-        {{- if $.Values.podLabels }}
-        {{- include "common.tplvalues.render" (dict "value" $.Values.podLabels "context" $) | nindent 8 }}
-        {{- end }}
+        shard: {{ $i | quote }}
     spec:
       serviceAccountName: {{ template "clickhouse.serviceAccountName" $ }}
       {{- include "clickhouse.imagePullSecrets" $ | nindent 6 }}
+      automountServiceAccountToken: {{ $.Values.automountServiceAccountToken }}
       {{- if $.Values.hostAliases }}
       hostAliases: {{- include "common.tplvalues.render" (dict "value" $.Values.hostAliases "context" $) | nindent 8 }}
       {{- end }}
@@ -49,8 +58,8 @@ spec:
       affinity: {{- include "common.tplvalues.render" ( dict "value" $.Values.affinity "context" $) | nindent 8 }}
       {{- else }}
       affinity:
-        podAffinity: {{- include "common.affinities.pods" (dict "type" $.Values.podAffinityPreset "component" "clickhouse" "context" $) | nindent 10 }}
-        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" $.Values.podAntiAffinityPreset "component" "clickhouse" "context" $) | nindent 10 }}
+        podAffinity: {{- include "common.affinities.pods" (dict "type" $.Values.podAffinityPreset "component" "clickhouse" "customLabels" $podLabels "context" $) | nindent 10 }}
+        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" $.Values.podAntiAffinityPreset "component" "clickhouse" "customLabels" $podLabels "extraPodAffinityTerms" (ternary (list (dict "extraMatchLabels" (dict "shard" $i) "topologyKey" "topology.kubernetes.io/zone")) (list) $.Values.distributeReplicasByZone) "context" $) | nindent 10 }}
         nodeAffinity: {{- include "common.affinities.nodes" (dict "type" $.Values.nodeAffinityPreset.type "key" $.Values.nodeAffinityPreset.key "values" $.Values.nodeAffinityPreset.values) | nindent 10 }}
       {{- end }}
       {{- if $.Values.nodeSelector }}
@@ -66,10 +75,10 @@ spec:
       schedulerName: {{ $.Values.schedulerName | quote }}
       {{- end }}
       {{- if $.Values.topologySpreadConstraints }}
-      topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" $.Values.topologySpreadConstraints "context" .) | nindent 8 }}
+      topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" $.Values.topologySpreadConstraints "context" $) | nindent 8 }}
       {{- end }}
       {{- if $.Values.podSecurityContext.enabled }}
-      securityContext: {{- omit $.Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
+      ssecurityContext: {{- omit $.Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
       {{- if $.Values.terminationGracePeriodSeconds }}
       terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
@@ -81,9 +90,11 @@ spec:
           imagePullPolicy: {{ $.Values.volumePermissions.image.pullPolicy | quote }}
           {{- if $.Values.resources }}
           resources: {{- toYaml $.Values.resources | nindent 12 }}
+          {{- else if ne $.Values.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" $.Values.resourcesPreset) | nindent 12 }}
           {{- end }}
-          # We don't require a privileged container in this case
           {{- if $.Values.containerSecurityContext.enabled }}
+          # We don't require a privileged container in this case
           securityContext: {{- omit $.Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
           {{- end }}
           command:
@@ -97,36 +108,47 @@ spec:
               mountPath: /tmp/certs
             - name: clickhouse-certificates
               mountPath: /opt/drycc/clickhouse/certs
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
         {{- else if and $.Values.volumePermissions.enabled $.Values.persistence.enabled }}
         - name: volume-permissions
           image: {{ include "clickhouse.volumePermissions.image" $ }}
           imagePullPolicy: {{ $.Values.volumePermissions.image.pullPolicy | quote }}
-          command: |
-            mkdir -p /drycc/clickhouse/data
-            chmod 700 /drycc/clickhouse/data
-            chown {{ $.Values.containerSecurityContext.runAsUser }}:{{ $.Values.podSecurityContext.fsGroup }} /drycc/clickhouse
-            find /drycc/clickhouse -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
-            xargs -r chown -R {{ $.Values.containerSecurityContext.runAsUser }}:{{ $.Values.podSecurityContext.fsGroup }}
-            {{- if $.Values.tls.enabled }}
-            cp /tmp/certs/* /opt/drycc/clickhouse/certs/
-            {{- if eq ( toString ( $.Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }}
-            chown -R `id -u`:`id -G | cut -d " " -f2` /opt/drycc/clickhouse/certs/
-            {{- else }}
-            chown -R {{ $.Values.containerSecurityContext.runAsUser }}:{{ $.Values.podSecurityContext.fsGroup }} /opt/drycc/clickhouse/certs/
-            {{- end }}
-            chmod 600 {{ include "clickhouse.tlsCertKey" $ }}
-            {{- end }}
-          {{- if $.Values.containerSecurityContext.enabled }}
-          securityContext: {{- omit $.Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
-          {{- end }}
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              mkdir -p /drycc/clickhouse/data
+              chmod 700 /drycc/clickhouse/data
+              {{- if $.Values.keeper.enabled }}
+              mkdir -p /drycc/clickhouse/keeper
+              chmod 700 /drycc/clickhouse/keeper
+              {{- end }}
+              chown {{ $.Values.containerSecurityContext.runAsUser }}:{{ $.Values.podSecurityContext.fsGroup }} /drycc/clickhouse
+              find /drycc/clickhouse -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
+              xargs -r chown -R {{ $.Values.containerSecurityContext.runAsUser }}:{{ $.Values.podSecurityContext.fsGroup }}
+              {{- if $.Values.tls.enabled }}
+              cp /tmp/certs/* /opt/drycc/clickhouse/certs/
+              {{- if eq ( toString ( $.Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }}
+              chown -R `id -u`:`id -G | cut -d " " -f2` /opt/drycc/clickhouse/certs/
+              {{- else }}
+              chown -R {{ $.Values.containerSecurityContext.runAsUser }}:{{ $.Values.podSecurityContext.fsGroup }} /opt/drycc/clickhouse/certs/
+              {{- end }}
+              chmod 600 {{ include "clickhouse.tlsCertKey" $ }}
+              {{- end }}
+          securityContext: {{- include "common.tplvalues.render" (dict "value" $.Values.volumePermissions.containerSecurityContext "context" $) | nindent 12 }}
           {{- if $.Values.volumePermissions.resources }}
           resources: {{- toYaml $.Values.volumePermissions.resources | nindent 12 }}
+          {{- else if ne $.Values.volumePermissions.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" $.Values.volumePermissions.resourcesPreset) | nindent 12 }}
           {{- end }}
           volumeMounts:
             - name: data
               mountPath: /drycc/clickhouse
-            - name: config
-              mountPath: /drycc/clickhouse/conf/default
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
             {{- if $.Values.tls.enabled }}
             - name: raw-certificates
               mountPath: /tmp/certs
@@ -155,7 +177,7 @@ spec:
           args: {{- include "common.tplvalues.render" (dict "value" $.Values.args "context" $) | nindent 12 }}
           {{- end }}
           env:
-            - name: DRYCC_DEBUG
+            - name: drycc_DEBUG
               value: {{ ternary "true" "false" (or $.Values.image.debug $.Values.diagnosticMode.enabled) | quote }}
             - name: CLICKHOUSE_HTTP_PORT
               value: {{ $.Values.containerPorts.http | quote }}
@@ -170,6 +192,18 @@ spec:
             {{- if $.Values.tls.enabled }}
             - name: CLICKHOUSE_TCP_SECURE_PORT
               value: {{ $.Values.containerPorts.tcpSecure | quote }}
+            - name: CLICKHOUSE_HTTPS_PORT
+              value: {{ $.Values.containerPorts.https | quote }}
+            {{- end }}
+            {{- if $.Values.keeper.enabled }}
+            - name: CLICKHOUSE_KEEPER_PORT
+              value: {{ $.Values.containerPorts.keeper | quote }}
+            - name: CLICKHOUSE_KEEPER_INTER_PORT
+              value: {{ $.Values.containerPorts.keeperInter | quote }}
+            {{- if $.Values.tls.enabled }}
+            - name: CLICKHOUSE_KEEPER_SECURE_PORT
+              value: {{ $.Values.containerPorts.keeperSecure | quote }}
+            {{- end }}
             {{- end }}
             {{- if $.Values.metrics.enabled }}
             - name: CLICKHOUSE_METRICS_PORT
@@ -196,9 +230,24 @@ spec:
             - name: CLICKHOUSE_TLS_CA_FILE
               value: {{ include "clickhouse.tlsCACert" $ | quote }}
             {{- end }}
-          {{- if $.Values.extraEnvVars }}
+            {{- if $.Values.extraEnvVars }}
             {{- include "common.tplvalues.render" (dict "value" $.Values.extraEnvVars "context" $) | nindent 12 }}
             {{- end }}
+            {{- if $.Values.keeper.enabled }}
+            {{- $replicas := $.Values.replicaCount | int }}
+            {{- range $j, $r := until $replicas }}
+            - name: {{ printf "KEEPER_NODE_%d" $j }}
+              value: {{ printf "%s-shard%d-%d.%s.%s.svc.%s" (include "common.names.fullname" $ ) $i $j (include "clickhouse.headlessServiceName" $) (include "common.names.namespace" $) $.Values.clusterDomain }}
+            - name: {{ printf "ZOOKEEPER_NODE_%d" $j }}
+              value: {{ printf "%s-shard%d-%d.%s.%s.svc.%s" (include "common.names.fullname" $ ) 0 $j (include "clickhouse.headlessServiceName" $) (include "common.names.namespace" $) $.Values.clusterDomain }}
+            {{- end }}
+            {{- else if $.Values.zookeeper.enabled }}
+            {{- $replicas := $.Values.zookeeper.replicaCount | int }}
+            {{- range $j, $r := until $replicas }}
+            - name: {{ printf "KEEPER_NODE_%d" $j }}
+              value: {{ printf "%s-%d.%s.%s.svc.%s" (include "clickhouse.zookeeper.fullname" $ ) $j (include "clickhouse.zookeeper.headlessServiceName" $) (include "common.names.namespace" $) $.Values.clusterDomain }}
+            {{- end }}
+            {{- end }}
           envFrom:
             {{- if $.Values.extraEnvVarsCM }}
             - configMapRef:
@@ -210,6 +259,8 @@ spec:
             {{- end }}
           {{- if $.Values.resources }}
           resources: {{- toYaml $.Values.resources | nindent 12 }}
+          {{- else if ne $.Values.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" $.Values.resourcesPreset) | nindent 12 }}
           {{- end }}
           ports:
             - name: http
@@ -217,9 +268,21 @@ spec:
             - name: tcp
               containerPort: {{ $.Values.containerPorts.tcp }}
             {{- if $.Values.tls.enabled }}
+            - name: https
+              containerPort: {{ $.Values.containerPorts.https }}
             - name: tcp-secure
               containerPort: {{ $.Values.containerPorts.tcpSecure }}
             {{- end }}
+            {{- if $.Values.keeper.enabled }}
+            - name: tcp-keeper
+              containerPort: {{ $.Values.containerPorts.keeper }}
+            - name: tcp-keeperinter
+              containerPort: {{ $.Values.containerPorts.keeperInter }}
+            {{- if $.Values.tls.enabled }}
+            - name: tcp-keepertls
+              containerPort: {{ $.Values.containerPorts.keeperSecure }}
+            {{- end }}
+            {{- end }}
             - name: tcp-postgresql
               containerPort: {{ $.Values.containerPorts.postgresql }}
             - name: tcp-mysql
@@ -235,8 +298,7 @@ spec:
           livenessProbe: {{- include "common.tplvalues.render" (dict "value" $.Values.customLivenessProbe "context" $) | nindent 12 }}
           {{- else if $.Values.livenessProbe.enabled }}
           livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit $.Values.livenessProbe "enabled") "context" $) | nindent 12 }}
-            httpGet:
-              path: /ping
+            tcpSocket:
               port: http
           {{- end }}
           {{- if $.Values.customReadinessProbe }}
@@ -260,6 +322,21 @@ spec:
           lifecycle: {{- include "common.tplvalues.render" (dict "value" $.Values.lifecycleHooks "context" $) | nindent 12 }}
           {{- end }}
           volumeMounts:
+            - name: empty-dir
+              mountPath: /opt/drycc/clickhouse/etc
+              subPath: app-conf-dir
+            - name: empty-dir
+              mountPath: /opt/drycc/clickhouse/logs
+              subPath: app-logs-dir
+            - name: empty-dir
+              mountPath: /opt/drycc/clickhouse/tmp
+              subPath: app-tmp-dir
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: scripts
+              mountPath: /scripts/setup.sh
+              subPath: setup.sh
             - name: data
               mountPath: /drycc/clickhouse
             - name: config
@@ -268,10 +345,18 @@ spec:
             - name: extra-config
               mountPath: /drycc/clickhouse/etc/conf.d/extra-configmap
           {{- end }}
+          {{- if or $.Values.usersExtraOverridesConfigmap $.Values.usersExtraOverrides }}
+            - name: users-extra-config
+              mountPath: /drycc/clickhouse/etc/users.d/users-extra-configmap
+          {{- end }}
           {{- if $.Values.extraOverridesSecret }}
             - name: extra-secret
               mountPath: /drycc/clickhouse/etc/conf.d/extra-secret
           {{- end }}
+          {{- if $.Values.usersExtraOverridesSecret }}
+            - name: users-extra-secret
+              mountPath: /drycc/clickhouse/etc/users.d/users-extra-secret
+          {{- end }}
           {{- if $.Values.tls.enabled }}
             - name: clickhouse-certificates
               mountPath: /drycc/clickhouse/certs
@@ -291,6 +376,12 @@ spec:
         {{- include "common.tplvalues.render" ( dict "value" $.Values.sidecars "context" $) | nindent 8 }}
         {{- end }}
       volumes:
+        - name: scripts
+          configMap:
+            name: {{ printf "%s-scripts" (include "common.names.fullname" $) }}
+            defaultMode: 0755
+        - name: empty-dir
+          emptyDir: {}
         - name: config
           configMap:
             name: {{ template "clickhouse.configmapName" $ }}
@@ -309,14 +400,28 @@ spec:
           configMap:
             name: {{ template "clickhouse.extraConfigmapName" $ }}
         {{- end }}
+        {{- if or $.Values.usersExtraOverridesConfigmap $.Values.usersExtraOverrides }}
+        - name: users-extra-config
+          configMap:
+            name: {{ template "clickhouse.usersExtraConfigmapName" $ }}
+        {{- end }}
         {{- if $.Values.extraOverridesSecret }}
         - name: extra-secret
           secret:
             secretName: {{ $.Values.extraOverridesSecret }}
         {{- end }}
+        {{- if $.Values.usersExtraOverridesSecret }}
+        - name: users-extra-secret
+          secret:
+            secretName: {{ $.Values.usersExtraOverridesSecret }}
+        {{- end }}
         {{- if not $.Values.persistence.enabled }}
         - name: data
           emptyDir: {}
+        {{- else if $.Values.persistence.existingClaim }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ tpl $.Values.persistence.existingClaim $ }}
         {{- end }}
         {{- if  $.Values.tls.enabled }}
         - name: raw-certificates
@@ -328,20 +433,18 @@ spec:
         {{- if $.Values.extraVolumes }}
         {{- include "common.tplvalues.render" (dict "value" $.Values.extraVolumes "context" $) | nindent 8 }}
         {{- end }}
-  {{- if $.Values.persistence.enabled }}
+  {{- if or $.Values.extraVolumeClaimTemplates (and $.Values.persistence.enabled (not $.Values.persistence.existingClaim)) }}
   volumeClaimTemplates:
+    {{- if and $.Values.persistence.enabled (not $.Values.persistence.existingClaim) }}
     - metadata:
         name: data
-        annotations:
-          {{- if $.Values.persistence.annotations }}
-          {{- include "common.tplvalues.render" (dict "value" $.Values.persistence.annotations "context" $) | nindent 10 }}
-          {{- end }}
-          {{- if $.Values.commonAnnotations }}
-          {{- include "common.tplvalues.render" (dict "value" $.Values.commonAnnotations "context" $) | nindent 10 }}
-          {{- end }}
-        {{- if $.Values.commonLabels }}
-        labels: {{- include "common.tplvalues.render" (dict "value" $.Values.commonLabels "context" $) | nindent 10 }}
+        {{- if or $.Values.persistence.annotations $.Values.commonAnnotations }}
+        {{- $claimAnnotations := include "common.tplvalues.merge" ( dict "values" ( list $.Values.persistence.annotations $.Values.commonLabels ) "context" $ ) }}
+        annotations: {{- include "common.tplvalues.render" ( dict "value" $claimAnnotations "context" $ ) | nindent 10 }}
         {{- end }}
+        {{- $claimLabels := include "common.tplvalues.merge" ( dict "values" ( list $.Values.persistence.labels $.Values.commonLabels ) "context" $ ) }}
+        labels: {{- include "common.labels.matchLabels" ( dict "customLabels" $claimLabels "context" $ ) | nindent 10 }}
+          app.kubernetes.io/component: clickhouse
       spec:
         accessModes:
         {{- range $.Values.persistence.accessModes }}
@@ -357,6 +460,10 @@ spec:
         dataSource: {{- include "common.tplvalues.render" (dict "value" $.Values.persistence.dataSource "context" $) | nindent 10 }}
         {{- end }}
         {{- include "common.storage.class" (dict "persistence" $.Values.persistence "global" $.Values.global) | nindent 8 }}
+    {{- end }}
+    {{- if $.Values.extraVolumeClaimTemplates }}
+    {{- include "common.tplvalues.render" ( dict "value" $.Values.extraVolumeClaimTemplates "context" $) | nindent 4 }}
+    {{- end }}
   {{- end }}
 ---
 {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/templates/tls-secret.yaml b/addons/clickhouse/24/chart/clickhouse/templates/tls-secret.yaml
index 2e443900..a85a09ad 100644
--- a/addons/clickhouse/24/chart/clickhouse/templates/tls-secret.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/templates/tls-secret.yaml
@@ -1,26 +1,29 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
 {{- if (include "clickhouse.createTlsSecret" . ) }}
+{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) }}
 {{- $ca := genCA "clickhouse-ca" 365 }}
 {{- $fullname := include "common.names.fullname" . }}
 {{- $releaseNamespace := .Release.Namespace }}
 {{- $clusterDomain := .Values.clusterDomain }}
 {{- $primaryHeadlessServiceName := printf "%s-headless" (include "common.names.fullname" .)}}
 {{- $altNames := list (printf "*.%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $primaryHeadlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $primaryHeadlessServiceName $releaseNamespace $clusterDomain) $fullname }}
-{{- $crt := genSignedCert $fullname nil $altNames 365 $ca }}
+{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ printf "%s-crt" (include "common.names.fullname" .) }}
+  name: {{ $secretName }}
   namespace: {{ .Release.Namespace | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
-    {{- if .Values.commonLabels }}
-    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
-    {{- end }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
 type: kubernetes.io/tls
 data:
-  ca.crt: {{ $ca.Cert | b64enc | quote }}
-  tls.crt: {{ $crt.Cert | b64enc | quote }}
-  tls.key: {{ $crt.Key | b64enc | quote }}
+  tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
+  tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
+  ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
 {{- end }}
diff --git a/addons/clickhouse/24/chart/clickhouse/values.yaml b/addons/clickhouse/24/chart/clickhouse/values.yaml
index b1764c87..4b6737ad 100644
--- a/addons/clickhouse/24/chart/clickhouse/values.yaml
+++ b/addons/clickhouse/24/chart/clickhouse/values.yaml
@@ -1,3 +1,6 @@
+# Copyright Broadcom, Inc. All Rights Reserved.
+# SPDX-License-Identifier: APACHE-2.0
+
 ## @section Global parameters
 ## Global Docker image parameters
 ## Please, note that this will override the image parameters, including dependencies, configured to use the global value
@@ -16,7 +19,15 @@ global:
   ##
   imagePullSecrets: []
   storageClass: ""
-
+  ## Compatibility adaptations for Kubernetes platforms
+  ##
+  compatibility:
+    ## Compatibility adaptations for Openshift
+    ##
+    openshift:
+      ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
+      ##
+      adaptSecurityContext: auto
 ## @section Common parameters
 ##
 
@@ -44,7 +55,6 @@ clusterDomain: cluster.local
 ## @param extraDeploy Array of extra objects to deploy with the release
 ##
 extraDeploy: []
-
 ## Enable diagnostic mode in the deployment
 ##
 diagnosticMode:
@@ -59,15 +69,14 @@ diagnosticMode:
   ##
   args:
     - infinity
-
 ## @section ClickHouse Parameters
 ##
 
-## Drycc ClickHouse image
+## drycc ClickHouse image
 ## ref: https://hub.docker.com/r/drycc/clickhouse/tags/
-## @param image.registry ClickHouse image registry
-## @param image.repository ClickHouse image repository
-## @param image.tag ClickHouse image tag (immutable tags are recommended)
+## @param image.registry [default: REGISTRY_NAME] ClickHouse image registry
+## @param image.repository [default: REPOSITORY_NAME/clickhouse] ClickHouse image repository
+## @skip image.tag ClickHouse image tag (immutable tags are recommended)
 ## @param image.digest ClickHouse image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
 ## @param image.pullPolicy ClickHouse image pull policy
 ## @param image.pullSecrets ClickHouse image pull secrets
@@ -80,7 +89,7 @@ image:
   digest: ""
   ## Specify a imagePullPolicy
   ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-  ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+  ## ref: http://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
   ##
   pullPolicy: IfNotPresent
   ## Optionally specify an array of imagePullSecrets.
@@ -97,13 +106,20 @@ image:
 ## @param shards Number of ClickHouse shards to deploy
 ##
 shards: 2
-
 ## @param replicaCount Number of ClickHouse replicas per shard to deploy
+## if keeper enable, same as keeper count, keeper cluster by shards.
+##
+replicaCount: 3
+## @param distributeReplicasByZone Schedules replicas of the same shard to different availability zones
 ##
-replicaCount: 2
+distributeReplicasByZone: false
 ## @param containerPorts.http ClickHouse HTTP container port
+## @param containerPorts.https ClickHouse HTTPS container port
 ## @param containerPorts.tcp ClickHouse TCP container port
-## @param containerPorts.tcpSecure ClickHouse TCP container port
+## @param containerPorts.tcpSecure ClickHouse TCP (secure) container port
+## @param containerPorts.keeper ClickHouse keeper TCP container port
+## @param containerPorts.keeperSecure ClickHouse keeper TCP (secure) container port
+## @param containerPorts.keeperInter ClickHouse keeper interserver TCP container port
 ## @param containerPorts.mysql ClickHouse MySQL container port
 ## @param containerPorts.postgresql ClickHouse PostgreSQL container port
 ## @param containerPorts.interserver ClickHouse Interserver container port
@@ -111,8 +127,12 @@ replicaCount: 2
 ##
 containerPorts:
   http: 8123
+  https: 8443
   tcp: 9000
   tcpSecure: 9440
+  keeper: 2181
+  keeperSecure: 3181
+  keeperInter: 9444
   mysql: 9004
   postgresql: 9005
   interserver: 9009
@@ -171,40 +191,63 @@ customReadinessProbe: {}
 ##
 customStartupProbe: {}
 ## ClickHouse resource requests and limits
-## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-## @param resources.limits The resources limits for the ClickHouse containers
-## @param resources.requests The requested resources for the ClickHouse containers
+## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
+## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).
+## More information: https://github.com/drycc/charts/blob/main/drycc/common/templates/_resources.tpl#L15
 ##
-resources:
-  limits: {}
-  requests: {}
+resourcesPreset: "small"
+## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
+## Example:
+## resources:
+##   requests:
+##     cpu: 2
+##     memory: 512Mi
+##   limits:
+##     cpu: 3
+##     memory: 1024Mi
+##
+resources: {}
 ## Configure Pods Security Context
 ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
 ## @param podSecurityContext.enabled Enabled ClickHouse pods' Security Context
+## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
+## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface
+## @param podSecurityContext.supplementalGroups Set filesystem extra groups
 ## @param podSecurityContext.fsGroup Set ClickHouse pod's Security Context fsGroup
-## @param podSecurityContext.seccompProfile.type Set ClickHouse container's Security Context seccomp profile
+## If you are using Kubernetes 1.18, the following code needs to be commented out.
 ##
 podSecurityContext:
   enabled: true
+  fsGroupChangePolicy: Always
+  sysctls: []
+  supplementalGroups: []
   fsGroup: 1001
-  seccompProfile:
-    type: "RuntimeDefault"
 ## Configure Container Security Context
 ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
-## @param containerSecurityContext.enabled Enabled ClickHouse containers' Security Context
-## @param containerSecurityContext.runAsUser Set ClickHouse containers' Security Context runAsUser
-## @param containerSecurityContext.runAsNonRoot Set ClickHouse containers' Security Context runAsNonRoot
-## @param containerSecurityContext.allowPrivilegeEscalation Set ClickHouse container's privilege escalation
-## @param containerSecurityContext.capabilities.drop Set ClickHouse container's Security Context runAsNonRoot
+## @param containerSecurityContext.enabled Enable containers' Security Context
+## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
+## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser
+## @param containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
+## @param containerSecurityContext.runAsNonRoot Set containers' Security Context runAsNonRoot
+## @param containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's
+## @param containerSecurityContext.privileged Set contraller container's Security Context privileged
+## @param containerSecurityContext.allowPrivilegeEscalation Set contraller container's Security Context allowPrivilegeEscalation
+## @param containerSecurityContext.capabilities.drop List of capabilities to be droppedn
+## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
 ##
 containerSecurityContext:
   enabled: true
+  seLinuxOptions: {}
   runAsUser: 1001
+  runAsGroup: 1001
   runAsNonRoot: true
+  privileged: false
   allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
   capabilities:
     drop: ["ALL"]
-
+  seccompProfile:
+    type: "RuntimeDefault"
 ## Authentication
 ## @param auth.username ClickHouse Admin username
 ## @param auth.password ClickHouse Admin password
@@ -216,11 +259,14 @@ auth:
   password: ""
   existingSecret: ""
   existingSecretKey: ""
-
 ## @param logLevel Logging level
 ##
 logLevel: information
-
+## @section ClickHouse keeper configuration parameters
+## @param keeper.enabled Deploy ClickHouse keeper. Support is experimental.
+##
+keeper:
+  enabled: true
 ## @param defaultConfigurationOverrides [string] Default configuration overrides (evaluated as a template)
 ##
 defaultConfigurationOverrides: |
@@ -238,7 +284,7 @@ defaultConfigurationOverrides: |
     {{- if or (ne (int .Values.shards) 1) (ne (int .Values.replicaCount) 1)}}
     <!-- Cluster configuration - Any update of the shards and replicas requires helm upgrade -->
     <remote_servers>
-      <default>
+      <cluster>
         {{- $shards := $.Values.shards | int }}
         {{- range $shard, $e := until $shards }}
         <shard>
@@ -247,22 +293,62 @@ defaultConfigurationOverrides: |
             <replica>
                 <host>{{ printf "%s-shard%d-%d.%s.%s.svc.%s" (include "common.names.fullname" $ ) $shard $i (include "clickhouse.headlessServiceName" $) (include "common.names.namespace" $) $.Values.clusterDomain }}</host>
                 <port>{{ $.Values.service.ports.tcp }}</port>
+                <user from_env="CLICKHOUSE_ADMIN_USER"></user>
+                <password from_env="CLICKHOUSE_ADMIN_PASSWORD"></password>
             </replica>
             {{- end }}
         </shard>
         {{- end }}
-      </default>
+      </cluster>
     </remote_servers>
     {{- end }}
-    {{- if or .Values.zookeeper.enabled .Values.externalZookeeper.servers }}
+    {{- if .Values.keeper.enabled }}
+    <!-- keeper configuration -->
+    <keeper_server>
+      {{/*ClickHouse keeper configuration using the helm chart */}}
+      <tcp_port>{{ $.Values.containerPorts.keeper }}</tcp_port>
+      {{- if .Values.tls.enabled }}
+      <tcp_port_secure>{{ $.Values.containerPorts.keeperSecure }}</tcp_port_secure>
+      {{- end }}
+      <server_id from_env="KEEPER_SERVER_ID"></server_id>
+      <log_storage_path>/drycc/clickhouse/keeper/coordination/log</log_storage_path>
+      <snapshot_storage_path>/drycc/clickhouse/keeper/coordination/snapshots</snapshot_storage_path>
+
+      <coordination_settings>
+          <operation_timeout_ms>10000</operation_timeout_ms>
+          <session_timeout_ms>30000</session_timeout_ms>
+          <raft_logs_level>trace</raft_logs_level>
+      </coordination_settings>
+
+      <raft_configuration>
+      {{- $nodes := .Values.replicaCount | int }}
+      {{- range $node, $e := until $nodes }}
+      <server>
+        <id>{{ $node | int }}</id>
+        <hostname from_env="{{ printf "KEEPER_NODE_%d" $node }}"></hostname>
+        <port>{{ $.Values.service.ports.keeperInter }}</port>
+      </server>
+      {{- end }}
+      </raft_configuration>
+    </keeper_server>
+    {{- end }}
+    {{- if or .Values.keeper.enabled .Values.zookeeper.enabled .Values.externalZookeeper.servers }}
     <!-- Zookeeper configuration -->
     <zookeeper>
-      {{- if .Values.zookeeper.enabled }}
+      {{- if or .Values.keeper.enabled }}
+      {{- $nodes := .Values.replicaCount | int }}
+      {{- range $node, $e := until $nodes }}
+      <node>
+        <host from_env="{{ printf "ZOOKEEPER_NODE_%d" $node }}"></host>
+        <port>{{ $.Values.service.ports.keeper }}</port>
+      </node>
+      {{- end }}
+      {{- else if .Values.zookeeper.enabled }}
       {{/* Zookeeper configuration using the helm chart */}}
       {{- $nodes := .Values.zookeeper.replicaCount | int }}
       {{- range $node, $e := until $nodes }}
       <node>
-        <host>{{ printf "%s-%d.%s.%s.svc.%s" (include "clickhouse.zookeeper.fullname" $ ) $node (include "clickhouse.zookeeper.headlessServiceName" $) (include "common.names.namespace" $) $.Values.clusterDomain }}</host>
+        <host from_env="{{ printf "KEEPER_NODE_%d" $node }}"></host>
         <port>{{ $.Values.zookeeper.service.ports.client }}</port>
       </node>
       {{- end }}
@@ -280,6 +366,7 @@ defaultConfigurationOverrides: |
     {{- if .Values.tls.enabled }}
     <!-- TLS configuration -->
     <tcp_port_secure from_env="CLICKHOUSE_TCP_SECURE_PORT"></tcp_port_secure>
+    <https_port from_env="CLICKHOUSE_HTTPS_PORT"></https_port>
     <openSSL>
         <server>
             {{- $certFileName := default "tls.crt" .Values.tls.certFilename }}
@@ -291,7 +378,7 @@ defaultConfigurationOverrides: |
             <disableProtocols>sslv2,sslv3</disableProtocols>
             <preferServerCiphers>true</preferServerCiphers>
             {{- if or .Values.tls.autoGenerated .Values.tls.certCAFilename }}
-            {{- $caFileName := default "ca.crt" .Values.tls.certFilename }}
+            {{- $caFileName := default "ca.crt" .Values.tls.certCAFilename }}
             <caConfig>/drycc/clickhouse/certs/{{$caFileName}}</caConfig>
             {{- else }}
             <loadDefaultCAFile>true</loadDefaultCAFile>
@@ -320,23 +407,27 @@ defaultConfigurationOverrides: |
     </prometheus>
     {{- end }}
   </clickhouse>
-
 ## @param existingOverridesConfigmap The name of an existing ConfigMap with your custom configuration for ClickHouse
 ##
 existingOverridesConfigmap: ""
-
 ## @param extraOverrides Extra configuration overrides (evaluated as a template) apart from the default
 ##
 extraOverrides: ""
-
 ## @param extraOverridesConfigmap The name of an existing ConfigMap with extra configuration for ClickHouse
 ##
 extraOverridesConfigmap: ""
-
 ## @param extraOverridesSecret The name of an existing ConfigMap with your custom configuration for ClickHouse
 ##
 extraOverridesSecret: ""
-
+## @param usersExtraOverrides Users extra configuration overrides (evaluated as a template) apart from the default
+##
+usersExtraOverrides: ""
+## @param usersExtraOverridesConfigmap The name of an existing ConfigMap with users extra configuration for ClickHouse
+##
+usersExtraOverridesConfigmap: ""
+## @param usersExtraOverridesSecret The name of an existing ConfigMap with your custom users configuration for ClickHouse
+##
+usersExtraOverridesSecret: ""
 ## @param initdbScripts Dictionary of initdb scripts
 ## Specify dictionary of scripts to be run at first boot
 ## Example:
@@ -349,7 +440,6 @@ initdbScripts: {}
 ## @param initdbScriptsSecret ConfigMap with the initdb scripts (Note: Overrides `initdbScripts`)
 ##
 initdbScriptsSecret: ""
-
 ## @param startdbScripts Dictionary of startdb scripts
 ## Specify dictionary of scripts to be run on every start
 ## Example:
@@ -362,13 +452,16 @@ startdbScripts: {}
 ## @param startdbScriptsSecret ConfigMap with the startdb scripts (Note: Overrides `startdbScripts`)
 ##
 startdbScriptsSecret: ""
-
 ## @param command Override default container command (useful when using custom images)
 ##
-command: []
+command:
+  - /scripts/setup.sh
 ## @param args Override default container args (useful when using custom images)
 ##
 args: []
+## @param automountServiceAccountToken Mount Service Account token in pod
+##
+automountServiceAccountToken: false
 ## @param hostAliases ClickHouse pods host aliases
 ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
 ##
@@ -412,7 +505,7 @@ nodeAffinityPreset:
 ##
 affinity: {}
 ## @param nodeSelector Node labels for ClickHouse pods assignment
-## ref: https://kubernetes.io/docs/user-guide/node-selection/
+## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
 ##
 nodeSelector: {}
 ## @param tolerations Tolerations for ClickHouse pods assignment
@@ -427,12 +520,10 @@ updateStrategy:
   ## Can be set to RollingUpdate or OnDelete
   ##
   type: RollingUpdate
-
 ## @param podManagementPolicy Statefulset Pod management policy, it needs to be Parallel to be able to complete the cluster join
 ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
 ##
 podManagementPolicy: Parallel
-
 ## @param priorityClassName ClickHouse pods' priorityClassName
 ##
 priorityClassName: ""
@@ -470,6 +561,9 @@ extraVolumes: []
 ## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for the ClickHouse container(s)
 ##
 extraVolumeMounts: []
+## @param extraVolumeClaimTemplates Optionally specify extra list of additional volumeClaimTemplates for the ClickHouse container(s)
+##
+extraVolumeClaimTemplates: []
 ## @param sidecars Add additional sidecar containers to the ClickHouse pod(s)
 ## e.g:
 ## sidecars:
@@ -491,7 +585,16 @@ sidecars: []
 ##    command: ['sh', '-c', 'echo "hello world"']
 ##
 initContainers: []
-
+## Pod Disruption Budget configuration
+## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb
+## @param pdb.create Enable/disable a Pod Disruption Budget creation
+## @param pdb.minAvailable Minimum number/percentage of pods that should remain scheduled
+## @param pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty.
+##
+pdb:
+  create: true
+  minAvailable: ""
+  maxUnavailable: ""
 ## TLS configuration
 ##
 tls:
@@ -515,7 +618,6 @@ tls:
   ## ref: https://www.postgresql.org/docs/9.6/auth-methods.html
   ##
   certCAFilename: ""
-
 ## @section Traffic Exposure Parameters
 ##
 
@@ -526,8 +628,12 @@ service:
   ##
   type: ClusterIP
   ## @param service.ports.http ClickHouse service HTTP port
+  ## @param service.ports.https ClickHouse service HTTPS port
   ## @param service.ports.tcp ClickHouse service TCP port
   ## @param service.ports.tcpSecure ClickHouse service TCP (secure) port
+  ## @param service.ports.keeper ClickHouse keeper TCP container port
+  ## @param service.ports.keeperSecure ClickHouse keeper TCP (secure) container port
+  ## @param service.ports.keeperInter ClickHouse keeper interserver TCP container port
   ## @param service.ports.mysql ClickHouse service MySQL port
   ## @param service.ports.postgresql ClickHouse service PostgreSQL port
   ## @param service.ports.interserver ClickHouse service Interserver port
@@ -535,16 +641,24 @@ service:
   ##
   ports:
     http: 8123
+    https: 443
     tcp: 9000
     tcpSecure: 9440
+    keeper: 2181
+    keeperSecure: 3181
+    keeperInter: 9444
     mysql: 9004
     postgresql: 9005
     interserver: 9009
     metrics: 8001
   ## Node ports to expose
   ## @param service.nodePorts.http Node port for HTTP
+  ## @param service.nodePorts.https Node port for HTTPS
   ## @param service.nodePorts.tcp Node port for TCP
   ## @param service.nodePorts.tcpSecure Node port for TCP (with TLS)
+  ## @param service.nodePorts.keeper ClickHouse keeper TCP container port
+  ## @param service.nodePorts.keeperSecure ClickHouse keeper TCP (secure) container port
+  ## @param service.nodePorts.keeperInter ClickHouse keeper interserver TCP container port
   ## @param service.nodePorts.mysql Node port for MySQL
   ## @param service.nodePorts.postgresql Node port for PostgreSQL
   ## @param service.nodePorts.interserver Node port for Interserver
@@ -553,8 +667,12 @@ service:
   ##
   nodePorts:
     http: ""
+    https: ""
     tcp: ""
     tcpSecure: ""
+    keeper: ""
+    keeperSecure: ""
+    keeperInter: ""
     mysql: ""
     postgresql: ""
     interserver: ""
@@ -587,7 +705,7 @@ service:
   extraPorts: []
   ## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin
   ## Values: ClientIP or None
-  ## ref: https://kubernetes.io/docs/user-guide/services/
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/
   ##
   sessionAffinity: None
   ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity
@@ -596,7 +714,12 @@ service:
   ##     timeoutSeconds: 300
   ##
   sessionAffinityConfig: {}
-
+  ## Headless service properties
+  ##
+  headless:
+    ## @param service.headless.annotations Annotations for the headless service.
+    ##
+    annotations: {}
 ## External Access to ClickHouse  configuration
 ##
 externalAccess:
@@ -611,8 +734,12 @@ externalAccess:
     ##
     type: LoadBalancer
     ## @param externalAccess.service.ports.http ClickHouse service HTTP port
+    ## @param externalAccess.service.ports.https ClickHouse service HTTPS port
     ## @param externalAccess.service.ports.tcp ClickHouse service TCP port
     ## @param externalAccess.service.ports.tcpSecure ClickHouse service TCP (secure) port
+    ## @param externalAccess.service.ports.keeper ClickHouse keeper TCP container port
+    ## @param externalAccess.service.ports.keeperSecure ClickHouse keeper TCP (secure) container port
+    ## @param externalAccess.service.ports.keeperInter ClickHouse keeper interserver TCP container port
     ## @param externalAccess.service.ports.mysql ClickHouse service MySQL port
     ## @param externalAccess.service.ports.postgresql ClickHouse service PostgreSQL port
     ## @param externalAccess.service.ports.interserver ClickHouse service Interserver port
@@ -620,8 +747,12 @@ externalAccess:
     ##
     ports:
       http: 80
+      https: 443
       tcp: 9000
       tcpSecure: 9440
+      keeper: 2181
+      keeperSecure: 3181
+      keeperInter: 9444
       mysql: 9004
       postgresql: 9005
       interserver: 9009
@@ -633,7 +764,7 @@ externalAccess:
     ##   - Y.Y.Y.Y
     ##
     loadBalancerIPs: []
-    ## @param externalAccess.service.loadBalancerAnnotations Array of load balancer annotations for each ClickHouse . Length must be the same as replicaCount
+    ## @param externalAccess.service.loadBalancerAnnotations Array of load balancer annotations for each ClickHouse . Length must be the same as shards multiplied by replicaCount
     ## e.g:
     ## loadBalancerAnnotations:
     ##   - external-dns.alpha.kubernetes.io/hostname: 1.external.example.com.
@@ -648,8 +779,12 @@ externalAccess:
     ##
     loadBalancerSourceRanges: []
     ## @param externalAccess.service.nodePorts.http Node port for HTTP
+    ## @param externalAccess.service.nodePorts.https Node port for HTTPS
     ## @param externalAccess.service.nodePorts.tcp Node port for TCP
     ## @param externalAccess.service.nodePorts.tcpSecure Node port for TCP (with TLS)
+    ## @param externalAccess.service.nodePorts.keeper ClickHouse keeper TCP container port
+    ## @param externalAccess.service.nodePorts.keeperSecure ClickHouse keeper TCP container port (with TLS)
+    ## @param externalAccess.service.nodePorts.keeperInter ClickHouse keeper interserver TCP container port
     ## @param externalAccess.service.nodePorts.mysql Node port for MySQL
     ## @param externalAccess.service.nodePorts.postgresql Node port for PostgreSQL
     ## @param externalAccess.service.nodePorts.interserver Node port for Interserver
@@ -663,8 +798,12 @@ externalAccess:
     ##
     nodePorts:
       http: []
+      https: []
       tcp: []
       tcpSecure: []
+      keeper: []
+      keeperSecure: []
+      keeperInter: []
       mysql: []
       postgresql: []
       interserver: []
@@ -678,9 +817,8 @@ externalAccess:
     ## @param externalAccess.service.extraPorts Extra ports to expose in the ClickHouse external service
     ##
     extraPorts: []
-
 ## ClickHouse ingress parameters
-## ref: http://kubernetes.io/docs/user-guide/ingress/
+## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/
 ##
 ingress:
   ## @param ingress.enabled Enable ingress record generation for ClickHouse
@@ -783,17 +921,19 @@ ingress:
   ##             name: http
   ##
   extraRules: []
-
 ## @section Persistence Parameters
 ##
 
 ## Enable persistence using Persistent Volume Claims
-## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/
+## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
 ##
 persistence:
   ## @param persistence.enabled Enable persistence using Persistent Volume Claims
   ##
   enabled: true
+  ## @param persistence.existingClaim Name of an existing PVC to use
+  ##
+  existingClaim: ""
   ## @param persistence.storageClass Storage class of backing PVC
   ## If defined, storageClassName: <storageClass>
   ## If set to "-", storageClassName: "", which disables dynamic provisioning
@@ -802,6 +942,9 @@ persistence:
   ##   GKE, AWS & OpenStack)
   ##
   storageClass: ""
+  ## @param persistence.labels Persistent Volume Claim labels
+  ##
+  labels: {}
   ## @param persistence.annotations Persistent Volume Claim annotations
   ##
   annotations: {}
@@ -812,7 +955,7 @@ persistence:
   ## @param persistence.size Size of data volume
   ##
   size: 8Gi
-  ## @param persistence.selector Selector to match an existing Persistent Volume for WordPress data PVC
+  ## @param persistence.selector Selector to match an existing Persistent Volume for ClickHouse data PVC
   ## If set, the PVC can't have a PV dynamically provisioned for it
   ## E.g.
   ## selector:
@@ -826,6 +969,16 @@ persistence:
 ## @section Init Container Parameters
 ##
 
+## persistentVolumeClaimRetentionPolicy
+## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention
+## @param persistentVolumeClaimRetentionPolicy.enabled Controls if and how PVCs are deleted during the lifecycle of a StatefulSet
+## @param persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced
+## @param persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted
+persistentVolumeClaimRetentionPolicy:
+  enabled: true
+  whenScaled: Delete
+  whenDeleted: Delete
+
 ## 'volumePermissions' init container parameters
 ## Changes the owner and group of the persistent volume mount point to runAsUser:fsGroup values
 ##   based on the *podSecurityContext/*containerSecurityContext parameters
@@ -834,18 +987,18 @@ volumePermissions:
   ## @param volumePermissions.enabled Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup`
   ##
   enabled: false
-  ## Drycc Shell image
-  ## ref: https://hub.docker.com/r/drycc/drycc-shell/tags/
-  ## @param volumePermissions.image.registry Drycc Shell image registry
-  ## @param volumePermissions.image.repository Drycc Shell image repository
-  ## @param volumePermissions.image.tag Drycc Shell image tag (immutable tags are recommended)
-  ## @param volumePermissions.image.pullPolicy Drycc Shell image pull policy
-  ## @param volumePermissions.image.pullSecrets Drycc Shell image pull secrets
+  ## OS Shell + Utility image
+  ## ref: https://hub.docker.com/r/drycc/os-shell/tags/
+  ## @param volumePermissions.image.registry [default: REGISTRY_NAME] OS Shell + Utility image registry
+  ## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] OS Shell + Utility image repository
+  ## @skip volumePermissions.image.tag OS Shell + Utility image tag (immutable tags are recommended)
+  ## @param volumePermissions.image.pullPolicy OS Shell + Utility image pull policy
+  ## @param volumePermissions.image.pullSecrets OS Shell + Utility image pull secrets
   ##
   image:
     registry: docker.io
-    repository: drycc/drycc-shell
-    tag: 11-debian-11-r37
+    repository: drycc/os-shell
+    tag: 12-debian-12-r22
     pullPolicy: IfNotPresent
     ## Optionally specify an array of imagePullSecrets.
     ## Secrets must be manually created in the namespace.
@@ -856,23 +1009,33 @@ volumePermissions:
     ##
     pullSecrets: []
   ## Init container's resource requests and limits
-  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-  ## @param volumePermissions.resources.limits The resources limits for the init container
-  ## @param volumePermissions.resources.requests The requested resources for the init container
+  ## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
+  ## @param volumePermissions.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production).
+  ## More information: https://github.com/drycc/charts/blob/main/drycc/common/templates/_resources.tpl#L15
   ##
-  resources:
-    limits: {}
-    requests: {}
+  resourcesPreset: "nano"
+  ## @param volumePermissions.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
+  ## Example:
+  ## resources:
+  ##   requests:
+  ##     cpu: 2
+  ##     memory: 512Mi
+  ##   limits:
+  ##     cpu: 3
+  ##     memory: 1024Mi
+  ##
+  resources: {}
   ## Init container Container Security Context
   ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+  ## @param volumePermissions.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
   ## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser
   ## NOTE: when runAsUser is set to special value "auto", init container will try to chown the
   ##   data folder to auto-determined user&group, using commands: `id -u`:`id -G | cut -d" " -f2`
   ##   "auto" is especially useful for OpenShift which has scc with dynamic user ids (and 0 is not allowed)
   ##
   containerSecurityContext:
+    seLinuxOptions: {}
     runAsUser: 0
-
 ## @section Other Parameters
 ##
 
@@ -891,8 +1054,7 @@ serviceAccount:
   annotations: {}
   ## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account
   ##
-  automountServiceAccountToken: true
-
+  automountServiceAccountToken: false
 ## Prometheus metrics
 ##
 metrics:
@@ -944,12 +1106,32 @@ metrics:
     ##
     relabelings: []
     ## @param metrics.serviceMonitor.selector Prometheus instance selector labels
-    ## ref: https://github.com/drycc/charts/tree/master/drycc/prometheus-operator#prometheus-configuration
+    ## ref: https://github.com/drycc/charts/tree/main/drycc/prometheus-operator#prometheus-configuration
     ## selector:
     ##   prometheus: my-prometheus
     ##
     selector: {}
-
+  ## Prometheus Operator PrometheusRule configuration
+  ##
+  prometheusRule:
+    ## @param metrics.prometheusRule.enabled Create a PrometheusRule for Prometheus Operator
+    ##
+    enabled: false
+    ## @param metrics.prometheusRule.namespace Namespace for the PrometheusRule Resource (defaults to the Release Namespace)
+    ##
+    namespace: ""
+    ## @param metrics.prometheusRule.additionalLabels Additional labels that can be used so PrometheusRule will be discovered by Prometheus
+    ##
+    additionalLabels: {}
+    ## @param metrics.prometheusRule.rules PrometheusRule definitions
+    ##  - alert: ClickhouseServerRestart
+    ##    annotations:
+    ##      message: Clickhouse-server started recently
+    ##    expr: ClickHouseAsyncMetrics_Uptime > 1 < 180
+    ##    for: 5m
+    ##    labels:
+    ##      severity: warning
+    rules: []
 ## @section External Zookeeper paramaters
 ##
 externalZookeeper:
@@ -958,7 +1140,6 @@ externalZookeeper:
   ##
   servers: []
   port: 2888
-
 ## @section Zookeeper subchart parameters
 ##
 ## @param zookeeper.enabled Deploy Zookeeper subchart
@@ -966,8 +1147,93 @@ externalZookeeper:
 ## @param zookeeper.service.ports.client Zookeeper client port
 ##
 zookeeper:
-  enabled: true
-  replicaCount: 2
+  enabled: false
+  ## Override zookeeper default image as 3.9 is not supported https://github.com/ClickHouse/ClickHouse/issues/53749
+  ## ref: https://github.com/drycc/containers/tree/main/drycc/zookeeper
+  ## @param zookeeper.image.registry [default: REGISTRY_NAME] Zookeeper image registry
+  ## @param zookeeper.image.repository [default: REPOSITORY_NAME/zookeeper] Zookeeper image repository
+  ## @skip zookeeper.image.tag Zookeeper image tag (immutable tags are recommended)
+  ## @param zookeeper.image.pullPolicy Zookeeper image pull policy
+  image:
+    registry: docker.io
+    repository: drycc/zookeeper
+    tag: 3.8.4-debian-12-r7
+    pullPolicy: IfNotPresent
+  replicaCount: 3
   service:
     ports:
       client: 2181
+  ## ZooKeeper resource requests and limits
+  ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
+  ## @param zookeeper.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).
+  ## More information: https://github.com/drycc/charts/blob/main/drycc/common/templates/_resources.tpl#L15
+  ##
+  resourcesPreset: "micro"
+  ## @param zookeeper.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
+  ## Example:
+  ## resources:
+  ##   requests:
+  ##     cpu: 2
+  ##     memory: 512Mi
+  ##   limits:
+  ##     cpu: 3
+  ##     memory: 1024Mi
+  ##
+  resources: {}
+## @section Network Policies
+## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
+##
+networkPolicy:
+  ## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created
+  ##
+  enabled: true
+  ## @param networkPolicy.allowExternal Don't require client label for connections
+  ## The Policy model to apply. When set to false, only pods with the correct
+  ## client label will have network access to the ports Clickhouse is listening
+  ## on. When true, Clickhouse will accept connections from any source
+  ## (with the correct destination port).
+  ##
+  allowExternal: true
+  ## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
+  ##
+  allowExternalEgress: true
+  ## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy
+  ## e.g:
+  ## extraIngress:
+  ##   - ports:
+  ##       - port: 1234
+  ##     from:
+  ##       - podSelector:
+  ##           - matchLabels:
+  ##               - role: frontend
+  ##       - podSelector:
+  ##           - matchExpressions:
+  ##               - key: role
+  ##                 operator: In
+  ##                 values:
+  ##                   - frontend
+  extraIngress: []
+  ## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
+  ## e.g:
+  ## extraEgress:
+  ##   - ports:
+  ##       - port: 1234
+  ##     to:
+  ##       - podSelector:
+  ##           - matchLabels:
+  ##               - role: frontend
+  ##       - podSelector:
+  ##           - matchExpressions:
+  ##               - key: role
+  ##                 operator: In
+  ##                 values:
+  ##                   - frontend
+  ##
+  extraEgress: []
+  ## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
+  ## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
+  ##
+  ingressNSMatchLabels: {}
+  ingressNSPodMatchLabels: {}
+  allowCurrentNamespace: true
+  allowNamespaces: 
\ No newline at end of file
diff --git a/addons/clickhouse/24/meta.yaml b/addons/clickhouse/24/meta.yaml
index fccf62bb..5dacdb78 100644
--- a/addons/clickhouse/24/meta.yaml
+++ b/addons/clickhouse/24/meta.yaml
@@ -1,5 +1,5 @@
 name: clickhouse
-version: 23
+version: 24
 id: 5606a4c8-d0b6-4ad0-98d2-3e4fde3055f6
 description: "clickhouse"
 displayName: "clickhouse"
@@ -21,4 +21,10 @@ allow_parameters:
 - name: "service.type"
   required: false
   description: "service type config for values.yaml"
+- name: "shards"
+  required: false
+  description: "service type config for values.yaml"
+- name: "replicaCount"
+  required: false
+  description: "service type config for values.yaml"
 archive: false
diff --git a/addons/clickhouse/24/plans/standard-16c64g1000/bind.yaml b/addons/clickhouse/24/plans/standard-16c64g1000/bind.yaml
new file mode 100644
index 00000000..8cddaa51
--- /dev/null
+++ b/addons/clickhouse/24/plans/standard-16c64g1000/bind.yaml
@@ -0,0 +1,24 @@
+credential:
+{{- if (eq .Values.service.type "LoadBalancer") }}
+  - name: {{ printf "EXTRANET_HOST" }}
+    valueFrom:
+      serviceRef:
+        name: {{ include "common.names.fullname" . }}
+        jsonpath: '{ .status.loadBalancer.ingress[*].ip }'
+{{- end }}
+  - name: {{ printf "HOST" }}
+    valueFrom:
+      serviceRef:
+        name: {{ include "common.names.fullname" . }}
+        jsonpath: '{ .spec.clusterIP }'
+  - name: PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: {{ template "common.names.fullname" . }}
+        jsonpath: '{ .data.admin-password }' 
+  - name: USERNAME
+    value: '{{ .Values.auth.username }}'
+  - name: TCP_PORT
+    value: 9000
+  - name: HTTP_PORT
+    value: 8123
\ No newline at end of file
diff --git a/addons/clickhouse/24/plans/standard-16c64g1000/create-instance-schema.json b/addons/clickhouse/24/plans/standard-16c64g1000/create-instance-schema.json
new file mode 100644
index 00000000..66ebbaa0
--- /dev/null
+++ b/addons/clickhouse/24/plans/standard-16c64g1000/create-instance-schema.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "type": "object",
+  "properties": {
+    "imagePullPolicy": {
+      "type": "string",
+      "enum": ["Always", "IfNotPresent", "Never"],
+      "default": "IfNotPresent",
+      "title": "Image pull policy"
+    }
+  }
+}
\ No newline at end of file
diff --git a/addons/clickhouse/24/plans/standard-16c64g1000/meta.yaml b/addons/clickhouse/24/plans/standard-16c64g1000/meta.yaml
new file mode 100644
index 00000000..7873429a
--- /dev/null
+++ b/addons/clickhouse/24/plans/standard-16c64g1000/meta.yaml
@@ -0,0 +1,6 @@
+name: "standard-16c64g1000"
+id: 6447a8c0-ab6c-4afd-8d1b-fe3be3ecfa3f
+description: "clickhouse standard-16c64g1000 plan: Disk 1000Gi ,vCPUs 16 , RAM 64G "
+displayName: "standard-16c64g1000"
+bindable: true
+maximum_polling_duration: 1800
\ No newline at end of file
diff --git a/addons/clickhouse/24/plans/standard-16c64g1000/values.yaml b/addons/clickhouse/24/plans/standard-16c64g1000/values.yaml
new file mode 100644
index 00000000..60735b83
--- /dev/null
+++ b/addons/clickhouse/24/plans/standard-16c64g1000/values.yaml
@@ -0,0 +1,23 @@
+## @param fullnameOverride String to fully override common.names.fullname template
+##
+fullnameOverride: hb-clickhouse-cluster-standard-16c64g1000
+
+## MinIO&reg; containers' resource requests and limits
+## ref: https://kubernetes.io/docs/user-guide/compute-resources/
+## We usually recommend not to specify default resources and to leave this as a conscious
+## choice for the user. This also increases chances charts run on environments with little
+## resources, such as Minikube. If you do want to specify resources, uncomment the following
+## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+## @param resources.limits The resources limits for the MinIO&reg; container
+## @param resources.requests The requested resources for the MinIO&reg; container
+##
+resources:
+  limits:
+    cpu: 16000m
+    memory: 64Gi
+  requests:
+    cpu: 16000m
+    memory: 64Gi
+
+persistence:
+  size: 1000Gi
\ No newline at end of file
diff --git a/addons/clickhouse/24/plans/standard-2c4g20/bind.yaml b/addons/clickhouse/24/plans/standard-2c4g20/bind.yaml
index 2f2ffbf1..090f1bb1 100644
--- a/addons/clickhouse/24/plans/standard-2c4g20/bind.yaml
+++ b/addons/clickhouse/24/plans/standard-2c4g20/bind.yaml
@@ -17,10 +17,8 @@ credential:
         name: {{ template "common.names.fullname" . }}
         jsonpath: '{ .data.admin-password }' 
   - name: USERNAME
-    value: 'administrator'
+    value: '{{ .Values.auth.username }}'
   - name: TCP_PORT
     value: 9000
   - name: HTTP_PORT
     value: 8123
-  - name: MYSQL_PORT
-    value: 9004
diff --git a/addons/clickhouse/24/plans/standard-4c16g100/bind.yaml b/addons/clickhouse/24/plans/standard-4c16g100/bind.yaml
index a66a7cd7..090f1bb1 100644
--- a/addons/clickhouse/24/plans/standard-4c16g100/bind.yaml
+++ b/addons/clickhouse/24/plans/standard-4c16g100/bind.yaml
@@ -17,10 +17,8 @@ credential:
         name: {{ template "common.names.fullname" . }}
         jsonpath: '{ .data.admin-password }' 
   - name: USERNAME
-    value: 'administrator'
+    value: '{{ .Values.auth.username }}'
   - name: TCP_PORT
     value: 9000
   - name: HTTP_PORT
     value: 8123
-  - name: MYSQL_PORT
-    value: 9004
\ No newline at end of file
diff --git a/addons/clickhouse/24/plans/standard-4c16g100/meta.yaml b/addons/clickhouse/24/plans/standard-4c16g100/meta.yaml
index ed5ad077..2cd181eb 100644
--- a/addons/clickhouse/24/plans/standard-4c16g100/meta.yaml
+++ b/addons/clickhouse/24/plans/standard-4c16g100/meta.yaml
@@ -1,6 +1,6 @@
 name: "standard-4c16g100"
 id: e30e5296-ce38-48cb-981c-9bb1c2e43833
-description: "clickhouse standard-4c16g100 plan: Disk 100Gi ,vCPUs c , RAM 16G "
+description: "clickhouse standard-4c16g100 plan: Disk 100Gi ,vCPUs 4 , RAM 16G "
 displayName: "standard-4c16g100"
 bindable: true
 maximum_polling_duration: 1800
\ No newline at end of file
diff --git a/addons/clickhouse/24/plans/standard-8c32g500/bind.yaml b/addons/clickhouse/24/plans/standard-8c32g500/bind.yaml
new file mode 100644
index 00000000..8cddaa51
--- /dev/null
+++ b/addons/clickhouse/24/plans/standard-8c32g500/bind.yaml
@@ -0,0 +1,24 @@
+credential:
+{{- if (eq .Values.service.type "LoadBalancer") }}
+  - name: {{ printf "EXTRANET_HOST" }}
+    valueFrom:
+      serviceRef:
+        name: {{ include "common.names.fullname" . }}
+        jsonpath: '{ .status.loadBalancer.ingress[*].ip }'
+{{- end }}
+  - name: {{ printf "HOST" }}
+    valueFrom:
+      serviceRef:
+        name: {{ include "common.names.fullname" . }}
+        jsonpath: '{ .spec.clusterIP }'
+  - name: PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: {{ template "common.names.fullname" . }}
+        jsonpath: '{ .data.admin-password }' 
+  - name: USERNAME
+    value: '{{ .Values.auth.username }}'
+  - name: TCP_PORT
+    value: 9000
+  - name: HTTP_PORT
+    value: 8123
\ No newline at end of file
diff --git a/addons/clickhouse/24/plans/standard-8c32g500/create-instance-schema.json b/addons/clickhouse/24/plans/standard-8c32g500/create-instance-schema.json
new file mode 100644
index 00000000..66ebbaa0
--- /dev/null
+++ b/addons/clickhouse/24/plans/standard-8c32g500/create-instance-schema.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "type": "object",
+  "properties": {
+    "imagePullPolicy": {
+      "type": "string",
+      "enum": ["Always", "IfNotPresent", "Never"],
+      "default": "IfNotPresent",
+      "title": "Image pull policy"
+    }
+  }
+}
\ No newline at end of file
diff --git a/addons/clickhouse/24/plans/standard-8c32g500/meta.yaml b/addons/clickhouse/24/plans/standard-8c32g500/meta.yaml
new file mode 100644
index 00000000..7f0eef62
--- /dev/null
+++ b/addons/clickhouse/24/plans/standard-8c32g500/meta.yaml
@@ -0,0 +1,6 @@
+name: "standard-8c32g500"
+id: 1bca5bdf-0bdc-406b-b3d0-865bdec9184c
+description: "clickhouse standard-8c32g500 plan: Disk 500Gi ,vCPUs 8 , RAM 32G "
+displayName: "standard-8c32g500"
+bindable: true
+maximum_polling_duration: 1800
\ No newline at end of file
diff --git a/addons/clickhouse/24/plans/standard-8c32g500/values.yaml b/addons/clickhouse/24/plans/standard-8c32g500/values.yaml
new file mode 100644
index 00000000..3d1c8a1e
--- /dev/null
+++ b/addons/clickhouse/24/plans/standard-8c32g500/values.yaml
@@ -0,0 +1,23 @@
+## @param fullnameOverride String to fully override common.names.fullname template
+##
+fullnameOverride: hb-clickhouse-cluster-standard-8c32g500
+
+## MinIO&reg; containers' resource requests and limits
+## ref: https://kubernetes.io/docs/user-guide/compute-resources/
+## We usually recommend not to specify default resources and to leave this as a conscious
+## choice for the user. This also increases chances charts run on environments with little
+## resources, such as Minikube. If you do want to specify resources, uncomment the following
+## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+## @param resources.limits The resources limits for the MinIO&reg; container
+## @param resources.requests The requested resources for the MinIO&reg; container
+##
+resources:
+  limits:
+    cpu: 8000m
+    memory: 32Gi
+  requests:
+    cpu: 8000m
+    memory: 32Gi
+
+persistence:
+  size: 500Gi
\ No newline at end of file
