diff --git a/Dockerfile b/Dockerfile
index 70097895dd2535c15b57c1969efbbb58678ec4d3..0a524b8b7bebadb7399a2d0cd4671dbb8bdb6e6e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -42,8 +42,8 @@ HEALTHCHECK --interval=5m --timeout=3s \
   CMD curl -fsL ${JENKINS_URL}/login || exit 1
 
 LABEL securitytxt="https://www.cloudbees.com/.well-known/security.txt"
-LABEL release=da3edc0598625e4129f5562827921449394afb42
-LABEL version=2.249.1.2
+LABEL release=4c482ecc2d194d4868ade0a8cb5f773a3ab1c0d5
+LABEL version=2.249.2.3
 
 ARG TARBALL=files.tar
 COPY ${TARBALL} /tmp
diff --git a/Jenkinsfile b/Jenkinsfile
index 1f62f3af87329a41eec00bdbc4358cd472c37441..6cbfdbdd8044f2215c4a432829af8c830dcd7f88 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -1,2 +1,2 @@
 @Library('DCCSCR@master') _
-dccscrPipeline(version: '2.249.1.2')
+dccscrPipeline(version: '2.249.2.3')
diff --git a/LICENSE.md b/LICENSE.adoc
similarity index 100%
rename from LICENSE.md
rename to LICENSE.adoc
diff --git a/README.md b/README.md
index 609be793221d1dc35eba9228397d274cfe611bb4..b2f5ad6b1b78f355900269d9880daddad3ab437e 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ CloudBees CI (formerly known as _CloudBees Core_) consists of three Docker image
 For each image, all files other than UBI and native packages
 are included in a `files.tar` marked with a SHA-256 checksum.
 
-A version of CloudBees CI is given in the format `2.249.1.2`
+A version of CloudBees CI is given in the format `2.249.2.3`
 where the first three components are aligned with a Jenkins LTS.
 The Helm chart is coversioned with `core-oc`.
 The `core-mm` image typically shares the same version,
@@ -22,13 +22,13 @@ plus whatever other customizations are desired:
 ```yaml
 OperationsCenter:
   Image:
-    dockerImage: your-registry/core-oc:2.249.1.2
+    dockerImage: your-registry/core-oc:2.249.2.3
 Master:
   Image:
-    dockerImage: your-registry/core-mm:2.249.1.2
+    dockerImage: your-registry/core-mm:2.249.2.3
 Agents:
   Image:
-    dockerImage: your-registry/agent:2.249.1.2
+    dockerImage: your-registry/agent:2.249.2.3
 ```
 
 and [install via Helm 3](https://docs.cloudbees.com/docs/cloudbees-core/latest/kubernetes-install-guide/installing-kubernetes-using-helm) using the local copy of the chart:
diff --git a/download.json b/download.json
index 0b5fd410d2fda4449170ca4d35316ea326fb106b..667cfd3e48ad6deb35ef2d74dcb8702b44fcb6f3 100644
--- a/download.json
+++ b/download.json
@@ -1,11 +1,11 @@
 {
   "resources": [
     {
-      "url": "https://downloads.cloudbees.com/dsop-files/core-oc-files-1a4963e50dd445eb045a63c87c52b02a7b2abdf64d5c048398943ed818186f30.tar",
+      "url": "https://downloads.cloudbees.com/dsop-files/core-oc-files-de64bf3a7e6d55e0c13bcf7ddbc72ef820c76548e6d18b4c1d990215e4773698.tar",
       "filename": "files.tar",
       "validation": {
         "type": "sha256",
-        "value": "1a4963e50dd445eb045a63c87c52b02a7b2abdf64d5c048398943ed818186f30"
+        "value": "de64bf3a7e6d55e0c13bcf7ddbc72ef820c76548e6d18b4c1d990215e4773698"
       }
     }
   ]
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
index eda12df5c7f534a0b709adb873f4bd66a768b1e0..7175dcbeb3caa7ce0f1b6e5483dcf4640ba919e5 100644
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -1,11 +1,11 @@
 apiVersion: v1
-appVersion: 2.249.1.2
+appVersion: 2.249.2.3
 description: The Continuous Delivery Solution for Enterprises
 engine: gotpl
-home: https://www.cloudbees.com/products/cloudbees-core
+home: https://www.cloudbees.com/products/continuous-integration
 icon: https://images.ctfassets.net/vtn4rfaw6n2j/7xprMMXARXDBuVxW4y8XfV/349fff91035050e3f2a8ff37bc0615b5/cloudbees-core-logo_header.svg
 keywords:
 - cloudbees
 - jenkins
 name: cloudbees-core
-version: 3.20.0-DEVELOPMENT
+version: 3.22.0-DEVELOPMENT
diff --git a/helm/README.md b/helm/README.md
index bbfc20ea87f109b0fb7b5954adc014f62258bfa7..3c7a9e13638816c56bf696d7ae87a9cd63ee68b0 100644
--- a/helm/README.md
+++ b/helm/README.md
@@ -1,5 +1,7 @@
 # cloudbees-core
 
+![Version: 3.22.0](https://img.shields.io/badge/Version-3.22.0-informational?style=flat-square) ![AppVersion: 2.249.2.3](https://img.shields.io/badge/AppVersion-2.249.2.3-informational?style=flat-square)
+
 [CloudBees Core](https://www.cloudbees.com/products/cloudbees-core) is the continuous delivery platform architected for the enterprise. It provides:
 
 * DevOps at scale
@@ -22,6 +24,14 @@ This chart bootstraps a CloudBees Core deployment on a [Kubernetes](http://kuber
   - Kubernetes 1.10 or higher
   - Helm 2.12 or higher
 
+## Requirements
+
+| Repository | Name | Version |
+|------------|------|---------|
+| https://charts.cloudbees.com/public/cloudbees | cloudbees-sidecar-injector | 2.0.7 |
+| https://kubernetes-charts.storage.googleapis.com/ | nginx-ingress | 1.40.2 |
+| https://kubernetes.github.io/ingress-nginx | ingress-nginx | 2.15.0 |
+
 ## Installing the Chart
 
 ### Default installation
@@ -36,10 +46,10 @@ $ helm install cloudbees/cloudbees-core \
 
 The command deploys CloudBees Core on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
 
-### Ingress Controller Installation 
+### Ingress Controller Installation
 
-The chart is designed, so it can install an nginx-ingress controller. 
-The `nginx.ingress.Enabled` field controls ingress controller installation and setup. 
+The chart is designed, so it can install an nginx-ingress controller.
+The `nginx.ingress.Enabled` field controls ingress controller installation and setup.
 To install the chart with the release name `cloudbees-core` and hostname cloudbees-core.example.com.
 
 ```console
@@ -56,19 +66,18 @@ To uninstall/delete the `cloudbees-core` deployment:
 $ helm delete cloudbees-core
 ```
 > **NOTE**: The current version of the CloudBees Core Helm Chart only manages the Operation Center.
-Users should manage Managed Master using Operation Center. 
+Users should manage Managed Master using Operation Center.
 
-The `helm delete` command stops the CloudBees Core deployment than removes the OperationsCenter Center. 
-The release is still stored in the Helm database, but it will now have the status deleted. 
+The `helm delete` command stops the CloudBees Core deployment than removes the OperationsCenter Center.
+The release is still stored in the Helm database, but it will now have the status deleted.
 If you wish to completely remove the release, use the following variation of the `helm delete` command.
 
 ```console
 $ helm delete cloudbees-core --purge
-``` 
+```
 
 > **IMPORTANT**: The `helm delete` command does NOT remove the persistent volume claims as precaution against data losss.
-You will need to use the `kubectl delete pvc` command to delete the persistent volumn claims. 
-
+You will need to use the `kubectl delete pvc` command to delete the persistent volumn claims.
 
 The command removes all the Kubernetes components associated with the chart and deletes the release.
 
@@ -79,12 +88,12 @@ The easiest way to consult it is through the command `helm inspect values cloudb
 
 Each property can override a default value with a value that specific to your Kubernetes cluster
 You can provide this values using the `--set` flag on the Helm command line.
- 
-Helm also support merging values files together, so that you can create a YAML file for each environment.   
+
+Helm also support merging values files together, so that you can create a YAML file for each environment.
 
 ### Environment Property Value Files
 Helm provides the option to use a custom property values file to override the default values set in the `values.yaml` file.
-CloudBees recommends creating a custom properties file to override the default for your environments, instead of directly editing the included values.yaml file. 
+CloudBees recommends creating a custom properties file to override the default for your environments, instead of directly editing the included values.yaml file.
 
 To use an environment property value file with Helm, use the -f option as shown in the following example:
 `helm install cloudbees-core --name cloudbees-core -f example-values.yaml`
@@ -93,3 +102,80 @@ You can download the latest version of the `example-values.yaml` file from Cloud
 
 ## Additional Documentation
 CloudBees provides complete and more detail installation and operation documentation on the CloudBees web site at https://go.cloudbees.com/docs/cloudbees-core/cloud-install-guide/kubernetes-helm-install/
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| Agents.Enabled | bool | `true` | Enable to create agent resources (service account, role) |
+| Agents.Image.dockerImage | string | `"063356183961.dkr.ecr.us-east-1.amazonaws.com/ubi/unified-distribution/agent:2.249.2.3"` | Used to override the default docker image used for agents |
+| Agents.SeparateNamespace.Create | bool | `false` | If true, the second namespace will be created when installing this chart. Otherwise, the existing namespace should be labeled with `cloudbees.com/role: agents` in order for network policies to work. |
+| Agents.SeparateNamespace.Enabled | bool | `false` | If enabled, agents resources will be created in a separate namespace as well as bindings allowing masters to schedule them. |
+| Agents.SeparateNamespace.Name | string | `nil` | Namespace where to create agents resources. Defaults to `${namespace}-builds` where `${namespace}` is the namespace where the chart is installed. |
+| Hibernation.Enabled | bool | `false` | Whether to enable the [Hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-masters#_hibernation_of_managed_masters) feature |
+| Hibernation.Image.dockerImage | string | `"cloudbees/managed-master-hibernation-monitor:230.ee066a318539"` | Used to override the default docker image |
+| Hibernation.Image.dockerPullPolicy | string | `"IfNotPresent"` | Used to override the default pull policy |
+| Master.Enabled | bool | `true` | Whether to create the resources required to schedule masters. |
+| Master.Image.dockerImage | string | `"063356183961.dkr.ecr.us-east-1.amazonaws.com/ubi/unified-distribution/core-mm:2.249.2.3"` | Used to override the default docker image |
+| Master.JavaOpts | string | `nil` | Additional Java options to pass to managed masters. For example, setting up a JMX port |
+| Master.OperationsCenterNamespace | string | `nil` | When deploying Master resources, this grants an Operations Center deployed in another namespace the right to deploy masters |
+| NetworkPolicy.Enabled | bool | `false` | Enable only if the cluster supports it. Read the [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) to understand what this is about. |
+| NetworkPolicy.JMXSelectors | list | `[]` | Custom selectors for accessing JMX port |
+| NetworkPolicy.ingressControllerSelector | list | `[]` | Custom selector for the ingress-controller |
+| OperationsCenter.AgentListenerPort | int | `50000` | Container port for agent listener traffic |
+| OperationsCenter.Annotations | object | `{}` | Additional annotations to put on the pod running Operations Center |
+| OperationsCenter.CSRF.ProxyCompatibility | bool | `false` | Proxy compatibility for the default CSRF issuer |
+| OperationsCenter.ContainerPort | int | `8080` | Container port for http traffic |
+| OperationsCenter.ContextPath | string | `"/cjoc"` | the path under which Operations Center will be accessible in the given host. |
+| OperationsCenter.Enabled | bool | `true` | Disable for particular use case like setting up namespaces to host masters only |
+| OperationsCenter.HealthProbeLivenessFailureThreshold | int | `12` | Threshold for liveness failure |
+| OperationsCenter.HealthProbes | bool | `true` | Enable Kubernetes Liveness and Readiness Probes |
+| OperationsCenter.HostName | string | `nil` | The hostname used to access Operations Center through the ingress controller. |
+| OperationsCenter.Image.dockerImage | string | `"063356183961.dkr.ecr.us-east-1.amazonaws.com/ubi/unified-distribution/core-oc:2.249.2.3"` | Container image to use for Operations Center |
+| OperationsCenter.Image.dockerPullPolicy | string | `"Always"` | https://kubernetes.io/docs/concepts/containers/images/#updating-images |
+| OperationsCenter.ImagePullSecrets | string | `nil` | The name of the image pull secret to pull private docker images |
+| OperationsCenter.Ingress.Annotations | object | `{"kubernetes.io/tls-acme":"false"}` | annotations to put on Ingress object |
+| OperationsCenter.Ingress.Class | string | `"nginx"` | Ingress class to use for OC and MM ingresses Should be set to the same value as nginx-ingress.controller.ingressClass if enabled |
+| OperationsCenter.Ingress.tls.Enable | bool | `false` | Set this to true in order to enable TLS on the ingress record |
+| OperationsCenter.Ingress.tls.SecretName | string | `nil` | The name of the secret containing the certificate and private key to terminate TLS for the ingress |
+| OperationsCenter.JavaOpts | string | `nil` | Additional java options to pass to the Operations Center |
+| OperationsCenter.JenkinsOpts | string | `nil` | Additional arguments for jenkins.war |
+| OperationsCenter.LoadBalancerIP | string | `nil` | Optionally assign a known public LB IP |
+| OperationsCenter.LoadBalancerSourceRanges | list | `["0.0.0.0/0"]` | Only applicable when using `ServiceType: LoadBalancer` |
+| OperationsCenter.NodeSelector | object | `{}` | Node labels and tolerations for pod assignment ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
+| OperationsCenter.Platform | string | `"standard"` | Enables specific settings depending on the platform platform specific values are: `eks`, `aws`, `gke`, `aks`, `pks`, `openshift`, `openshift4` Note: `openshift` maps to OpenShift 3.x |
+| OperationsCenter.Protocol | string | `"http"` | the protocol used to access CJOC. Possible values are http/https. |
+| OperationsCenter.Resources.Limits.Cpu | int | `1` | CPU limit to run Operations Center https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu |
+| OperationsCenter.Resources.Limits.Memory | string | `"2G"` | Memory limit to run Operations Center https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory |
+| OperationsCenter.Resources.Requests.Cpu | int | `1` | CPU request to run Operations Center https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu |
+| OperationsCenter.Resources.Requests.Memory | string | `"2G"` | Memory request to run Operations Center https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory |
+| OperationsCenter.Route.tls.Enable | bool | `false` | Set this to true in OpenShift to terminate TLS at route level |
+| OperationsCenter.ServiceAgentListenerPort | int | `50000` | Controls the service port where Operations Center TCP port for agents is exposed. Don't change this parameter unless you know what you are doing |
+| OperationsCenter.ServiceAnnotations | object | `{}` | Additional annotations to put on the Operations Center service |
+| OperationsCenter.ServicePort | int | `80` | Controls the service port where Operations Center http port is exposed. Don't change this parameter unless you know what you are doing |
+| OperationsCenter.ServiceType | string | `"ClusterIP"` | Service Type. Defaults to ClusterIP, since we recommend using an ingress controller. |
+| OperationsCenter.Tolerations | list | `[]` | Specify tolerations for the Operations Center pod. See [documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
+| Persistence.AccessMode | string | `"ReadWriteOnce"` | Access mode for the PVC ([doc](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes)) |
+| Persistence.Annotations | object | `{}` | Annotations to put on the PVC |
+| Persistence.Size | string | `"20Gi"` | Size of the Operations Center volume |
+| Persistence.StorageClass | string | `nil` | Persistent Volume Storage Class for Jenkins Home If defined, storageClassName: <storageClass>. If set to "-", storageClassName: "", which disables dynamic provisioning. If undefined (the default) or set to null, the default storage class will be used, unless specified otherwise below. If setting OperationsCenter.Platform == gke, a storage class backed with SSD drives will be created by this chart and used automatically. |
+| Persistence.mounts | list | `[]` | Additional volume mounts to attach to Operations Center container |
+| Persistence.volumes | list | `[]` | Additional volumes to attach to Operations Center pod |
+| PodSecurityPolicy.Annotations | object | `{}` | Additional annotations to put on the PodSecurityPolicy, e.g. AppArmor/Seccomp settings |
+| PodSecurityPolicy.Enabled | bool | `false` | Enables [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) support Enable only if the cluster supports it. |
+| ingress-nginx.Enabled | bool | `false` | Installs the [ingress-nginx](https://github.com/kubernetes/ingress-nginx/tree/master/charts/ingress-nginx) controller (optional). Enable this section if you don't have an existing installation of ingress-nginx controller Note: use `beta.kubernetes.io/os` when deploying on Kubernetes versions below 1.16 |
+| ingress-nginx.controller.ingressClass | string | `"nginx"` |  |
+| ingress-nginx.controller.nodeSelector."kubernetes.io/os" | string | `"linux"` |  |
+| ingress-nginx.controller.service.externalTrafficPolicy | string | `"Local"` |  |
+| ingress-nginx.defaultBackend.nodeSelector."kubernetes.io/os" | string | `"linux"` |  |
+| nginx-ingress.Enabled | bool | `false` | Installs the [nginx-ingress](https://github.com/helm/charts/tree/master/stable/nginx-ingress) controller (optional). DEPRECATED - Use ingress-nginx section instead. Enable this section if you don't have an existing installation of nginx-ingress controller Note: use `beta.kubernetes.io/os` when deploying on Kubernetes versions below 1.16 |
+| nginx-ingress.controller.ingressClass | string | `"nginx"` |  |
+| nginx-ingress.controller.nodeSelector."kubernetes.io/os" | string | `"linux"` |  |
+| nginx-ingress.controller.service.externalTrafficPolicy | string | `"Local"` |  |
+| nginx-ingress.defaultBackend.nodeSelector."kubernetes.io/os" | string | `"linux"` |  |
+| rbac.agentsServiceAccountName | string | `"jenkins-agents"` |  |
+| rbac.hibernationMonitorServiceAccountName | string | `"managed-master-hibernation-monitor"` | Name of the service account the Hibernation monitor will run as (if enabled) |
+| rbac.install | bool | `true` | Install `role`/`rolebindings`/`serviceAccount`. If false (and rbac is enabled in the cluster anyway), provide valid names for `serviceAccountName`, `masterServiceAccountName` and `hibernationMonitorServiceAccountName` |
+| rbac.masterServiceAccountName | string | `"jenkins"` | Name of the service account Jenkins masters will run as |
+| rbac.serviceAccountName | string | `"cjoc"` | Name of the service account Operations Center will run as |
+| sidecarinjector.Enabled | bool | `false` | Whether to enable installation of Sidecar Injector |
diff --git a/helm/README.md.gotmpl b/helm/README.md.gotmpl
new file mode 100644
index 0000000000000000000000000000000000000000..3f3b13a1f5f868461359ced4c9450f0a6dea83b9
--- /dev/null
+++ b/helm/README.md.gotmpl
@@ -0,0 +1,101 @@
+# cloudbees-core
+
+{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}
+
+[CloudBees Core](https://www.cloudbees.com/products/cloudbees-core) is the continuous delivery platform architected for the enterprise. It provides:
+
+* DevOps at scale
+* Resilience and high availability
+* Easy management
+* Enterprise grade security
+
+## TL;DR;
+
+```console
+$ helm repo add cloudbees https://charts.cloudbees.com/public/cloudbees
+$ helm install cloudbees/cloudbees-core --name <release name>
+```
+
+## Introduction
+
+This chart bootstraps a CloudBees Core deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Prerequisites
+  - Kubernetes 1.10 or higher
+  - Helm 2.12 or higher
+
+{{ template "chart.requirementsSection" . }}
+
+## Installing the Chart
+
+### Default installation
+
+To install the chart with the release name `cloudbees-core` and hostname `cloudbees-core.example.com`. The default installation requires nginx-ingress controller to be installed. The chart can install the nginx-ingress controller for you. This installation is described in the next section.
+
+```console
+$ helm install cloudbees/cloudbees-core \
+       --name cloudbees-core \
+       --set OperationsCenter.HostName='cloudbees-core.example.com'
+```
+
+The command deploys CloudBees Core on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
+
+### Ingress Controller Installation
+
+The chart is designed, so it can install an nginx-ingress controller.
+The `nginx.ingress.Enabled` field controls ingress controller installation and setup.
+To install the chart with the release name `cloudbees-core` and hostname cloudbees-core.example.com.
+
+```console
+$ helm install cloudbees/cloudbees-core \
+       --name cloudbees-core \
+       --set nginx.ingress.Enabled=true
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the `cloudbees-core` deployment:
+
+```console
+$ helm delete cloudbees-core
+```
+> **NOTE**: The current version of the CloudBees Core Helm Chart only manages the Operation Center.
+Users should manage Managed Master using Operation Center.
+
+The `helm delete` command stops the CloudBees Core deployment than removes the OperationsCenter Center.
+The release is still stored in the Helm database, but it will now have the status deleted.
+If you wish to completely remove the release, use the following variation of the `helm delete` command.
+
+```console
+$ helm delete cloudbees-core --purge
+```
+
+> **IMPORTANT**: The `helm delete` command does NOT remove the persistent volume claims as precaution against data losss.
+You will need to use the `kubectl delete pvc` command to delete the persistent volumn claims.
+
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+## Configuration
+
+Please refer to the chart `values.yaml` to get the exhaustive list of values that can be customized.
+The easiest way to consult it is through the command `helm inspect values cloudbees/cloudbees-core`.
+
+Each property can override a default value with a value that specific to your Kubernetes cluster
+You can provide this values using the `--set` flag on the Helm command line.
+
+Helm also support merging values files together, so that you can create a YAML file for each environment.
+
+### Environment Property Value Files
+Helm provides the option to use a custom property values file to override the default values set in the `values.yaml` file.
+CloudBees recommends creating a custom properties file to override the default for your environments, instead of directly editing the included values.yaml file.
+
+To use an environment property value file with Helm, use the -f option as shown in the following example:
+`helm install cloudbees-core --name cloudbees-core -f example-values.yaml`
+
+You can download the latest version of the `example-values.yaml` file from CloudBees Examples GitHub repository at https://github.com/cloudbees/cloudbees-examples/tree/master/helm-custom-value-file-examples.
+
+## Additional Documentation
+CloudBees provides complete and more detail installation and operation documentation on the CloudBees web site at https://go.cloudbees.com/docs/cloudbees-core/cloud-install-guide/kubernetes-helm-install/
+
+{{ template "chart.valuesSection" . }}
diff --git a/helm/requirements.lock b/helm/requirements.lock
index 83131d098db8d1657e2c82a3bd5398ae9ec9b841..8511053a21e654374f92be531fbe227212602d2a 100644
--- a/helm/requirements.lock
+++ b/helm/requirements.lock
@@ -2,8 +2,11 @@ dependencies:
 - name: nginx-ingress
   repository: https://kubernetes-charts.storage.googleapis.com/
   version: 1.40.2
+- name: ingress-nginx
+  repository: https://kubernetes.github.io/ingress-nginx
+  version: 2.15.0
 - name: cloudbees-sidecar-injector
   repository: https://charts.cloudbees.com/public/cloudbees
-  version: 2.0.6
-digest: sha256:d030d7cde88b3247e6924bbd0dd3c00e5708edbe6fae2bdba9ed7eaa9ca2cc24
-generated: "2020-09-15T12:13:54.481668733Z"
+  version: 2.0.7
+digest: sha256:10f7e8c53d0a6f910f4dbe0fd253fbefd288fb5fc24365635968e99b3bc75dbf
+generated: "2020-10-07T14:35:15.239221954Z"
diff --git a/helm/requirements.yaml b/helm/requirements.yaml
index 18a57c459cc24efa7458969651109ec01fb22b50..1747d0150a5aed9b7cac9bebe8cd526877ee447d 100644
--- a/helm/requirements.yaml
+++ b/helm/requirements.yaml
@@ -3,7 +3,11 @@ dependencies:
   version: 1.40.2
   repository: https://kubernetes-charts.storage.googleapis.com/
   condition: nginx-ingress.Enabled
+- name: ingress-nginx
+  version: 2.15.0
+  repository: https://kubernetes.github.io/ingress-nginx
+  condition: ingress-nginx.Enabled
 - name: cloudbees-sidecar-injector
-  version: 2.0.6
+  version: 2.0.7
   repository: https://charts.cloudbees.com/public/cloudbees
   condition: sidecarinjector.Enabled
diff --git a/helm/templates/_helpers.tpl b/helm/templates/_helpers.tpl
index 19e590a00d411762a99eaea1834f484fc70c2a80..485a0fa5d19eded24e0c90cd2a17c68bc25fe4bc 100644
--- a/helm/templates/_helpers.tpl
+++ b/helm/templates/_helpers.tpl
@@ -256,11 +256,22 @@ Plural versions for usage in network policy ingress rules
 - namespaceSelector:
     matchLabels:
       network.openshift.io/policy-group: ingress
-{{- else if not (include "cloudbees-core.is-openshift" .) -}}
+{{- else if (not (include "cloudbees-core.is-openshift" .)) -}}
 {{ include "nginxingress.podSelectors" . }}
 {{- end -}}
 {{- end -}}
 
+{{- define "ingress.name" -}}
+{{- if index .Values "nginx-ingress" "Enabled" -}}
+nginx-ingress
+{{- else if index .Values "ingress-nginx" "Enabled" -}}
+ingress-nginx
+{{- else -}}
+ingress-nginx
+{{- end -}}
+{{- end -}}
+
+{{/* stable/nginx-ingress chart going away in Nov. 2020. This will be part of the 10/2020 release. Delete this after 4/2021 */}}
 {{- define "nginxingress.podSelectors" -}}
 {{- if  index .Values "nginx-ingress" "Enabled" }}
 {{ include "nginxingress.includedPodSelector" . }}
@@ -274,33 +285,49 @@ Plural versions for usage in network policy ingress rules
 {{- define "nginxingress.includedPodSelector" -}}
 - podSelector:
     matchLabels:
-      app: nginx-ingress
+      app: {{ include "ingress.name" . }}
       component: controller
 {{- end -}}
 
 {{- define "nginxingress.defaultPodSelectors" -}}
 - namespaceSelector:
     matchLabels:
-      name: nginx-ingress
+      name: {{ include "ingress.name" . }}
   podSelector:
     matchLabels:
-      app: nginx-ingress
+      app: {{ include "ingress.name" . }}
       component: controller
 - namespaceSelector:
     matchLabels:
       name: ingress-nginx
   podSelector:
     matchLabels:
-      app: nginx-ingress
+      app: {{ include "ingress.name" . }}
       component: controller
 - namespaceSelector:
     matchLabels:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/part-of: ingress-nginx
+      name: ingress-nginx
   podSelector:
     matchLabels:
       app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/part-of: ingress-nginx
+      app.kubernetes.io/component: controller
+{{- end -}}
+
+{{- define "ingressnginx.podSelectors" -}}
+{{- if  index .Values "ingress-nginx" "Enabled" }}
+{{ include "ingressnginx.includedPodSelector" . }}
+{{- else if .Values.NetworkPolicy.ingressControllerSelector }}
+{{ toYaml .Values.NetworkPolicy.ingressControllerSelector -}}
+{{- else }}
+{{ include "ingressnginx.defaultPodSelectors" . }}
+{{- end }}
+{{- end -}}
+
+{{- define "ingressnginx.includedPodSelector" -}}
+- podSelector:
+    matchLabels:
+      app: {{ include "ingress.name" . }}
+      component: controller
 {{- end -}}
 
 {{- define "networkpolicy.cjoc.http" -}}
@@ -376,3 +403,9 @@ status:
 {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}
+
+{{- define "ingress.check" -}}
+{{- if and (index .Values "nginx-ingress" "Enabled") (index .Values "ingress-nginx" "Enabled") -}}
+  {{ fail "\n\nERROR: Only one of nginx-ingress.Enabled or ingress-nginx.Enabled may be true" }}
+{{- end -}}
+{{- end -}}
diff --git a/helm/templates/cjoc-ingress.yaml b/helm/templates/cjoc-ingress.yaml
index c4801c3e14904c6f63321087ba4c117f994f8b63..60ee882992b1e591856996a2f8809f8bfc3cc8bf 100644
--- a/helm/templates/cjoc-ingress.yaml
+++ b/helm/templates/cjoc-ingress.yaml
@@ -1,5 +1,6 @@
 {{- if .Values.OperationsCenter.Enabled -}}
 {{- if include "cloudbees-core.needs-ingress" . -}}
+{{- include "ingress.check" . -}}
 apiVersion: {{ include "ingress.apiVersion" . }}
 kind: Ingress
 metadata:
@@ -33,7 +34,7 @@ spec:
 {{- if .Values.OperationsCenter.Ingress.tls.Enable }}
   tls:
     - hosts:
-        - {{ .Values.OperationsCenter.Ingress.tls.Host }}
+        - {{ .Values.OperationsCenter.HostName | quote }}
       secretName: {{ .Values.OperationsCenter.Ingress.tls.SecretName }}
 {{- end -}}
 {{- end -}}
diff --git a/helm/templates/managed-master-hibernation-monitor-ingress.yaml b/helm/templates/managed-master-hibernation-monitor-ingress.yaml
index ae8ba12e5c6ee401285123109678fe6c1c94c276..3e3b8ebb2381af42625f71f781dde2f74fbc2da0 100644
--- a/helm/templates/managed-master-hibernation-monitor-ingress.yaml
+++ b/helm/templates/managed-master-hibernation-monitor-ingress.yaml
@@ -7,9 +7,11 @@ metadata:
   labels:
 {{ include "cloudbees-core.labels" . | indent 4 }}
   annotations:
+{{ toYaml .Values.OperationsCenter.Ingress.Annotations | indent 4 }}
+{{ if .Values.OperationsCenter.Ingress.Class }}
     kubernetes.io/ingress.class: {{ .Values.OperationsCenter.Ingress.Class }}
+{{- end }}
     nginx.ingress.kubernetes.io/ssl-redirect: "{{- template "ingress.ssl_redirect" . }}"
-    # TODO should OperationsCenter.Ingress.Annotations be honored here?
 spec:
   rules:
   -
@@ -29,7 +31,7 @@ spec:
 {{- if .Values.OperationsCenter.Ingress.tls.Enable }}
   tls:
     - hosts:
-        - {{ .Values.OperationsCenter.Ingress.tls.Host }}
+        - {{ .Values.OperationsCenter.HostName | quote }}
       secretName: {{ .Values.OperationsCenter.Ingress.tls.SecretName }}
 {{- end -}}
 {{- end -}}
diff --git a/helm/values.yaml b/helm/values.yaml
index 92087f1b2ffcd842db4ca131befa32f078a6deac..9711d1cb30fc1f274ebd2574ad82be9c485a22df 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -2,7 +2,23 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
-# Installs the nginx ingress controller (optional)
+# ingress-nginx.Enabled -- Installs the [ingress-nginx](https://github.com/kubernetes/ingress-nginx/tree/master/charts/ingress-nginx) controller (optional).
+# Enable this section if you don't have an existing installation of ingress-nginx controller
+# Note: use `beta.kubernetes.io/os` when deploying on Kubernetes versions below 1.16
+ingress-nginx:
+  Enabled: false
+  controller:
+    ingressClass: nginx
+    nodeSelector:
+      kubernetes.io/os: linux
+    service:
+      externalTrafficPolicy: Local
+  defaultBackend:
+    nodeSelector:
+      kubernetes.io/os: linux
+
+# nginx-ingress.Enabled -- Installs the [nginx-ingress](https://github.com/helm/charts/tree/master/stable/nginx-ingress) controller (optional).
+# DEPRECATED - Use ingress-nginx section instead.
 # Enable this section if you don't have an existing installation of nginx-ingress controller
 # Note: use `beta.kubernetes.io/os` when deploying on Kubernetes versions below 1.16
 nginx-ingress:
@@ -23,52 +39,60 @@ nginx-ingress:
 # without having to build custom docker images.
 # Use helm inspect readme cloudbees/cloudbees-sidecar-injector to read more on this optional components
 sidecarinjector:
+  # sidecarinjector.Enabled -- Whether to enable installation of Sidecar Injector
   Enabled: false
 
 # Operations Center options
 OperationsCenter:
-  # Disable for particular use case like setting up namespaces to host masters only
+  # OperationsCenter.Enabled -- Disable for particular use case like setting up namespaces to host masters only
   Enabled: true
 
   # Operations Center docker image
   Image:
-    dockerImage: dcar/core-oc:2.249.1.2
+    # OperationsCenter.Image.dockerImage -- Container image to use for Operations Center
+    dockerImage: dcar/core-oc:2.249.2.3
+    # OperationsCenter.Image.dockerPullPolicy -- https://kubernetes.io/docs/concepts/containers/images/#updating-images
     dockerPullPolicy: IfNotPresent
 
   # Image pull secrets
   # Enable this option when using a private registry.
   # https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-line
-  # ImagePullSecrets: my-k8s-secret
+  # OperationsCenter.ImagePullSecrets -- The name of the image pull secret to pull private docker images
+  ImagePullSecrets: null
 
-  # Platform enables specific settings, option defaults standard
-  # platform specific values are: eks, aws, gke, aks, pks, openshift, openshift4
-  # Note: openshift maps to OpenShift 3.x
+  # OperationsCenter.Platform -- Enables specific settings depending on the platform
+  # platform specific values are: `eks`, `aws`, `gke`, `aks`, `pks`, `openshift`, `openshift4`
+  # Note: `openshift` maps to OpenShift 3.x
   Platform: standard
 
-  # The hostname used to access Operations Center through the ingress controller.
+  # OperationsCenter.HostName -- The hostname used to access Operations Center through the ingress controller.
   HostName: null
 
-  # ContextPath under which Operations Center will be accessible in the given host.
+  # OperationsCenter.ContextPath -- the path under which Operations Center will be accessible in the given host.
   ContextPath: /cjoc
 
-  # Protocol used to access CJOC. Possible values are http/https.
+  # OperationsCenter.Protocol -- the protocol used to access CJOC. Possible values are http/https.
   Protocol: http
   # Protocol: https
 
-  # Port used to access CJOC. Defaults to 80/443 depending on Protocol. Can be overriden.
+  # OperationsCenter.Port -- the port used to access CJOC. Defaults to 80/443 depending on Protocol. Can be overridden.
   # Port: 80
 
   # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container
   Resources:
     Limits:
-      # CPU limit to run Operations Center
+      # OperationsCenter.Resources.Limits.Cpu -- CPU limit to run Operations Center
       # https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
       Cpu: 1
-      # Memory limit to run Operations Center
+      # OperationsCenter.Resources.Limits.Memory -- Memory limit to run Operations Center
       # https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
       Memory: 2G
     Requests:
+      # OperationsCenter.Resources.Requests.Cpu -- CPU request to run Operations Center
+      # https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
       Cpu: 1
+      # OperationsCenter.Resources.Requests.Memory -- Memory request to run Operations Center
+      # https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
       Memory: 2G
 
   # Environment variables that get added to the container (useful for e.g. http_proxy)
@@ -76,8 +100,8 @@ OperationsCenter:
   #   - name: http_proxy
   #     value: "http://192.168.64.1:3128"
 
-  # Additional java options to pass to the Operations Center
-  # JavaOpts: ""
+  # OperationsCenter.JavaOpts -- Additional java options to pass to the Operations Center
+  JavaOpts: null
   #   -Dcom.sun.management.jmxremote.port=4000
   #   -Dcom.sun.management.jmxremote.authenticate=false
   #   -Dcom.sun.management.jmxremote.ssl=false
@@ -85,8 +109,8 @@ OperationsCenter:
   # Container port where JMX is exposed
   # JMXPort: 4000
 
-  # Additional arguments for jenkins.war
-  # JenkinsOpts: ""
+  # OperationsCenter.JenkinsOpts -- Additional arguments for jenkins.war
+  JenkinsOpts: null
 
   # Run the Operations Center as a specific user (defaults to uid 1000)
   # When setting RunAsUser to a different value than 0 also set FsGroup to the same value:
@@ -98,68 +122,68 @@ OperationsCenter:
   # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#discussion
   # FsGroup: 1000
 
-  # Controls the service port where Operations Center http port is exposed.
-  # Don't change this parameter unless you know what you are doing
+  # OperationsCenter.ServicePort -- Controls the service port where Operations Center http port is exposed. Don't change this parameter unless you know what you are doing
   ServicePort: 80
-  # Controls the service port where Operations Center TCP port for agents is exposed.
-  # Don't change this parameter unless you know what you are doing
+  # OperationsCenter.ServiceAgentListenerPort -- Controls the service port where Operations Center TCP port for agents is exposed. Don't change this parameter unless you know what you are doing
   ServiceAgentListenerPort: 50000
 
-  # Service Type
-  # Defaults to ClusterIP, since we recommend using an ingress controller.
+  # OperationsCenter.ServiceType -- Service Type. Defaults to ClusterIP, since we recommend using an ingress controller.
   ServiceType: ClusterIP
 
-  # Additional annotations to put on the Operations Center service
+  # OperationsCenter.ServiceAnnotations -- Additional annotations to put on the Operations Center service
   ServiceAnnotations: {}
   #   service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https
 
-  # Container port for http traffic
+  # OperationsCenter.ContainerPort -- Container port for http traffic
   ContainerPort: 8080
 
-  # Container port for agent listener traffic
+  # OperationsCenter.AgentListenerPort -- Container port for agent listener traffic
   AgentListenerPort: 50000
-  # Enable Kubernetes Liveness and Readiness Probes
+  # OperationsCenter.HealthProbes -- Enable Kubernetes Liveness and Readiness Probes
   HealthProbes: true
+  # OperationsCenter.HealthProbeLivenessFailureThreshold -- Threshold for liveness failure
   HealthProbeLivenessFailureThreshold: 12
 
-  # Proxy compatibility for the default CSRF issuer
   # https://wiki.jenkins.io/display/JENKINS/CSRF+Protection
   CSRF:
+    # OperationsCenter.CSRF.ProxyCompatibility -- Proxy compatibility for the default CSRF issuer
     ProxyCompatibility: false
 
-  # Only used when ServiceType: LoadBalancer
-  # https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
+  # OperationsCenter.LoadBalancerSourceRanges -- Only applicable when using `ServiceType: LoadBalancer`
   LoadBalancerSourceRanges:
   - 0.0.0.0/0
-  # Optionally assign a known public LB IP
+  # OperationsCenter.LoadBalancerIP -- Optionally assign a known public LB IP
+  LoadBalancerIP: null
   # LoadBalancerIP: 1.2.3.4
 
-  # Node labels and tolerations for pod assignment
+  # OperationsCenter.NodeSelector -- Node labels and tolerations for pod assignment
   # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
   NodeSelector: {}
-  # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature
+  # OperationsCenter.Tolerations -- Specify tolerations for the Operations Center pod.
+  # See [documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
   Tolerations: []
 
-  # Additional annotations to put on the pod running Operations Center
+  # OperationsCenter.Annotations -- Additional annotations to put on the pod running Operations Center
   Annotations: {}
 
   Ingress:
-    # Ingress class to use for OC and MM ingresses
+    # OperationsCenter.Ingress.Class -- Ingress class to use for OC and MM ingresses
     # Should be set to the same value as nginx-ingress.controller.ingressClass if enabled
     Class: nginx
-    # Annotations to put on Ingress object
+    # OperationsCenter.Ingress.Annotations -- annotations to put on Ingress object
     Annotations:
       kubernetes.io/tls-acme: 'false'
 
     tls:
-      ## Set this to true in order to enable TLS on the ingress record
+      # OperationsCenter.Ingress.tls.Enable -- Set this to true in order to enable TLS on the ingress record
       Enable: false
-      SecretName: cloudbees-core-example-com-tls
-      Host: jenkins.cluster.local
+      # OperationsCenter.Ingress.tls.SecretName -- The name of the secret containing the certificate
+      # and private key to terminate TLS for the ingress
+      SecretName: null
 
-  # OpenShift uses a Route instead of an Ingress, this section is added to match the opensource Jenkins Chart
   Route:
     tls:
+      # OperationsCenter.Route.tls.Enable -- Set this to true in OpenShift to terminate TLS at route level
       Enable: false
 
   ## @param ExtraConfigMaps - array of objects - optional
@@ -209,88 +233,91 @@ OperationsCenter:
 
 # Master options
 Master:
+  # Master.Enabled -- Whether to create the resources required to schedule masters.
   Enabled: true
-  # When deploying Master resources, this grants an Operations Center deployed in another namespace the right to deploy masters
+  # Master.OperationsCenterNamespace -- When deploying Master resources, this grants an Operations Center deployed in another namespace the right to deploy masters
   OperationsCenterNamespace: null
 
   # Docker image inserted in Operations Center automatically
   Image:
-    dockerImage: dcar/core-mm:2.249.1.2
-    dockerPullPolicy: IfNotPresent
-  # Additional Java options to pass to managed masters. For example, setting up a JMX port
+    # Master.Image.dockerImage -- Used to override the default docker image
+    dockerImage: dcar/core-mm:2.249.2.3
+  # Master.JavaOpts -- Additional Java options to pass to managed masters. For example, setting up a JMX port
   JavaOpts: null
 
 # Agent options
 Agents:
+  # Agents.Enabled -- Enable to create agent resources (service account, role)
   Enabled: true
   SeparateNamespace:
-    # If enabled, agents resources will be created in a separate namespace as well as bindings allowing masters to schedule them.
+    # Agents.SeparateNamespace.Enabled -- If enabled, agents resources will be created in a separate namespace as well as bindings allowing masters to schedule them.
     Enabled: false
-    # Namespace where to create agents resources. Defaults to ${namespace}-builds where ${namespace} is the namespace where the chart is installed.
+    # Agents.SeparateNamespace.Name -- Namespace where to create agents resources. Defaults to `${namespace}-builds` where `${namespace}` is the namespace where the chart is installed.
     Name: null
-    # If true, the second namespace will be created when installing this chart.
-    # Otherwise, the existing namespace should be labeled with "cloudbees.com/role: agents" in order for network policies to work.
+    # Agents.SeparateNamespace.Create -- If true, the second namespace will be created when installing this chart. Otherwise, the existing namespace should be labeled with `cloudbees.com/role: agents` in order for network policies to work.
     Create: false
   Image:
-    # Used to override the default docker image used for agents
-    dockerImage: dcar/agent:2.249.1.2
+    # Agents.Image.dockerImage -- Used to override the default docker image used for agents
+    dockerImage: dcar/agent:2.249.2.3
 
 Persistence:
-  ## Persistent Volume Storage Class for Jenkins Home
-  ## If defined, storageClassName: <storageClass>
-  ## If set to "-", storageClassName: "", which disables dynamic provisioning
-  ##
-  ## If undefined (the default) or set to null, the default storage class will be used,
-  ## unless specified otherwise below.
-  ##
-  ## If setting OperationsCenter.Platform == gke, a storage class backed with
-  ## SSD drives will be created by this chart and used automatically.
-  ##
+  # Persistence.StorageClass -- Persistent Volume Storage Class for Jenkins Home
+  # If defined, storageClassName: <storageClass>.
+  # If set to "-", storageClassName: "", which disables dynamic provisioning.
+  # If undefined (the default) or set to null, the default storage class will be used,
+  # unless specified otherwise below.
+  # If setting OperationsCenter.Platform == gke, a storage class backed with
+  # SSD drives will be created by this chart and used automatically.
+  #
   # StorageClass: "-"
+  StorageClass: null
 
   # On AKS, use the following
   # StorageClass: "managed-premium"
 
-  # Annotations to put on the PVC
+  # Persistence.Annotations -- Annotations to put on the PVC
   Annotations: {}
+  # Persistence.AccessMode -- Access mode for the PVC ([doc](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes))
   AccessMode: ReadWriteOnce
 
-  # Size of the Operations Center volume
+  # Persistence.Size -- Size of the Operations Center volume
   Size: 20Gi
 
-  # Additional volumes to attach to Operations Center pod
-  volumes:
+  # Persistence.volumes -- Additional volumes to attach to Operations Center pod
+  volumes: []
 #  - name: nothing
 #    emptyDir: {}
-  # Additional volume mounts to attach to Operations Center container
-  mounts:
+  # Persistence.mounts -- Additional volume mounts to attach to Operations Center container
+  mounts: []
 #  - mountPath: /var/nothing
 #    name: nothing
 #    readOnly: true
 
 # Master hibernation
 Hibernation:
+  # Hibernation.Enabled -- Whether to enable the [Hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-masters#_hibernation_of_managed_masters) feature
   Enabled: false
   Image:
+    # Hibernation.Image.dockerImage -- Used to override the default docker image
     dockerImage: cloudbees/managed-master-hibernation-monitor:230.ee066a318539
+    # Hibernation.Image.dockerPullPolicy -- Used to override the default pull policy
     dockerPullPolicy: IfNotPresent
 
 PodSecurityPolicy:
   # Requires rbac.installCluster = true
   #
+  # PodSecurityPolicy.Enabled -- Enables [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) support
   # Enable only if the cluster supports it.
-  # https://kubernetes.io/docs/concepts/policy/pod-security-policy/
   Enabled: false
-  # Additional annotations to put on the PodSecurityPolicy, e.g. AppArmor/Seccomp settings
+  # PodSecurityPolicy.Annotations -- Additional annotations to put on the PodSecurityPolicy, e.g. AppArmor/Seccomp settings
   Annotations: {}
 
 NetworkPolicy:
-  # Enable only if the cluster supports it.
-  # https://kubernetes.io/docs/concepts/services-networking/network-policies/
+  # NetworkPolicy.Enabled -- Enable only if the cluster supports it. Read the [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) to understand what this is about.
   Enabled: false
 
-  # Custom selector for the ingress-controller
-  ingressControllerSelector:
+  # NetworkPolicy.ingressControllerSelector -- Custom selector for the ingress-controller
+  ingressControllerSelector: []
 #    - namespaceSelector:
 #        matchLabels:
 #          name: nginx-ingress
@@ -299,8 +326,8 @@ NetworkPolicy:
 #         app: nginx-ingress
 #         component: controller
 
-  # Custom selectors for accessing JMX port
-  JMXSelectors:
+  # NetworkPolicy.JMXSelectors -- Custom selectors for accessing JMX port
+  JMXSelectors: []
 #    - namespaceSelector:
 #        matchLabels:
 #          name: datadog
@@ -310,23 +337,21 @@ NetworkPolicy:
 
 ## Install Default RBAC roles and bindings
 rbac:
-  # Install role/rolebindings/serviceAccount.
-  # If false (and rbac is enabled in the cluster anyway), provide valid names for
-  # - serviceAccountName
-  # - masterServiceAccountName
-  # - hibernationMonitorServiceAccountName
+  # rbac.install -- Install `role`/`rolebindings`/`serviceAccount`.
+  # If false (and rbac is enabled in the cluster anyway), provide valid names for `serviceAccountName`, `masterServiceAccountName` and `hibernationMonitorServiceAccountName`
   install: true
 
-  # Install clusterrole/clusterrolebinding
+  # rbac.installCluster -- Install `clusterrole`/`clusterrolebinding`
   # These cluster roles are optional but prevent usage of some features, so we recommend setting them up.
   # Defaults to true, except on Openshift 3 where it defaults to false
   # Please refer to templates/cjoc-clusterrole-master-management.yaml in the chart
   #installCluster: true
 
-  # Name of the service account Operations Center will run as
+  # rbac.serviceAccountName -- Name of the service account Operations Center will run as
   serviceAccountName: cjoc
-  # Name of the service account Jenkins masters will run as
+  # rbac.masterServiceAccountName -- Name of the service account Jenkins masters will run as
   masterServiceAccountName: jenkins
+  # rbac.agentServiceAccountName -- Name of the service account Jenkins agents will run as
   agentsServiceAccountName: jenkins-agents
-  # Name of the service account the Hibernation monitor will run as (if enabled)
+  # rbac.hibernationMonitorServiceAccountName -- Name of the service account the Hibernation monitor will run as (if enabled)
   hibernationMonitorServiceAccountName: managed-master-hibernation-monitor
diff --git a/scripts/usr/local/bin/jenkins.sh b/scripts/usr/local/bin/jenkins.sh
index f9061e5214d203e0be690b65bf1be6ffcaec3125..f67b156dba8ee6c6bc934eba2580902a9723a218 100644
--- a/scripts/usr/local/bin/jenkins.sh
+++ b/scripts/usr/local/bin/jenkins.sh
@@ -52,7 +52,7 @@ find /usr/share/jenkins/ref/ -type f -exec bash -c "copy_reference_file '{}'" \;
 
 # if `docker run` first argument start with `--` the user is passing jenkins launcher arguments
 if [[ $# -lt 1 ]] || [[ "$1" == "--"* ]]; then
-  eval "exec java ${JAVA_OPTS:-} -jar -Dcb.distributable.name=\"Docker Common CJE\" -Dcb.distributable.commit_sha=da3edc0598625e4129f5562827921449394afb42 /usr/share/jenkins/jenkins.war $JENKINS_OPTS \"\$@\""
+  eval "exec java ${JAVA_OPTS:-} -jar -Dcb.distributable.name=\"Docker Common CJE\" -Dcb.distributable.commit_sha=4c482ecc2d194d4868ade0a8cb5f773a3ab1c0d5 /usr/share/jenkins/jenkins.war $JENKINS_OPTS \"\$@\""
 fi
 
 # As argument is not jenkins, assume user want to run his own process, for sample a `bash` shell to explore this image