Repository: camunda/camunda-platform-helm
Pull request #885 (2023-09-13 16:31:50)

feat: extra initContainers for all components
### Which problem does the PR fix?

Fixes: #886 and #209

### What's in this PR?

<!--
  Explain the contents of the PR.
  Give an overview about the implementation, which decisions were made and why.
-->
This PR adds a place in values.yaml where a user can input a container spec for extra init containers they want deployed. Also added the extra configuration option to the README.md 
### Checklist

Please make sure to follow our [Contributing Guide](../blob/main/CONTRIBUTING.md).

<!-- Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields. -->

**Before opening the PR:**

- [x] There is no other open [pull request](../pulls) for the same update/change.
- [x] The commits follow our [Commit Guidelines](../blob/main/CONTRIBUTING.md#commit-guidelines).
- [x] Tests for charts are added (if needed).
- [x] The main Helm chart and sub-chart are updated (if needed).
- [x] In-repo [documentation](../blob/main/CONTRIBUTING.md#documentation) are updated (if needed).

**After opening the PR:**

- [x] Did you sign our CLA (Contributor License Agreement)? It will show once you open the PR.
- [x] Did all checks/tests pass in the PR?

<!--
### To-Do

- [ ] If the PR is not complete but you want to discuss the approach,
  list what remains to be done here.
-->



Patch:
diff --git a/.tool-versions b/.tool-versions
index fcd38b42..332cf7e5 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,6 +1,6 @@
 helm 3.12.3
 # The kubectl version depends on the K8s CI cluster version
-kubectl 1.27.5
+kubectl 1.27.6
 kustomize 5.1.1
 golang 1.21.1
 # Task is mainly used to run tests locally or in the CI pipeline.
diff --git a/charts/camunda-platform/README.md b/charts/camunda-platform/README.md
index 4f43fec1..b1e454fe 100644
--- a/charts/camunda-platform/README.md
+++ b/charts/camunda-platform/README.md
@@ -336,7 +336,8 @@ For more information about Zeebe, visit [Zeebe Overview](https://docs.camunda.io
 | | `pvcStorageClassName` | Can be used to set the storage class name which should be used by the persistent volume claim. It is recommended to use a storage class, which is backed with a SSD. | ` ` |
 | | `extraVolumes` | Can be used to define extra volumes for the broker pods, useful for additional exporters | `[ ]`|
 | | `extraVolumeMounts` | Can be used to mount extra volumes for the broker pods, useful for additional exporters | `[ ]` |
-| | `extraInitContainers` | Can be used to set up extra init containers for the broker pods, useful for additional exporters | `[ ]` |
+| | `extraInitContainers` | (Deprecated - use `initContainers` instead) Can be used to set up extra init containers for the broker pods, useful for additional exporters | `[ ]` |
+| | `initContainers` | Can be used to set up extra init containers for the broker pods, useful for additional exporters | `[ ]` |
 | | `podAnnotations` | Can be used to define extra broker pod annotations | `{ }` |
 | | `podLabels` | Can be used to define extra broker pod labels | `{ }` |
 | | `podDisruptionBudget` | Configuration to configure a [pod disruption budget](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) for the broker pods | |
@@ -434,7 +435,8 @@ For more information about Zeebe Gateway, visit
 | | `affinity` | Can be used to define [pod affinity or anti-affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity). The default defined PodAntiAffinity allows constraining on which nodes the [Zeebe gateway pods are scheduled on](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity). It uses a hard requirement for scheduling and works based on the Zeebe gateway pod labels. | `podAntiAffinity:</br>  requiredDuringSchedulingIgnoredDuringExecution:</br>  - labelSelector: </br>    matchExpressions:</br>    - key: "app.kubernetes.io/component"</br>    operator: In</br>    values:</br>    - zeebe-gatway</br>  topologyKey: "kubernetes.io/hostname"` |
 | | `extraVolumeMounts` | Can be used to mount extra volumes for the gateway pods, useful for enabling TLS between gateway and broker | `[ ]` |
 | | `extraVolumes` | Can be used to define extra volumes for the gateway pods, useful for enabling TLS between gateway and broker | `[ ]` |
-| | `extraInitContainers` | Can be used to set up extra init containers for the gateway pods, useful for adding interceptors | `[ ]` |
+| | `extraInitContainers` | (Deprecated - use `initContainers` instead) Can be used to set up extra init containers for the gateway pods, useful for adding interceptors | `[ ]` |
+| | `initContainers` | Can be used to set up extra init containers for the broker pods, useful for additional exporters | `[ ]` |
 | | `service` | Configuration for the gateway service | |
 | | `service.type` | Defines the [type of the service](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types) | `ClusterIP` |
 | | `service.loadBalancerIP` | Can be used to set [ip address](https://cloud.google.com/kubernetes-engine/docs/how-to/service-parameters#lb_ip) if service.type is LoadBalancer | `""` |
@@ -475,6 +477,7 @@ For more information about Operate, visit
 | | `image.tag` | Can be set to overwrite the global tag, which should be used in that chart. | `` |
 | | `image.pullSecrets` | Can be set to overwrite the global.image.pullSecrets | `{{ global.image.pullSecrets }}` |
 | | `sidecars` | Can be used to deploy extra containers in the same pod | `[]` |
+| | `initContainers` | Can be used to set up extra init containers for the operate pods, useful for additional exporters | `[ ]` |
 | | `contextPath` |  Can be used to make Operate web application works on a custom sub-path. This is mainly used to run Camunda Platform web applications under a single domain. | |
 | | `podAnnotations` | Can be used to define extra Operate pod annotations | `{ }` |
 | | `podLabels` |  Can be used to define extra Operate pod labels | `{ }` |
@@ -547,6 +550,7 @@ For more information about Tasklist, visit
 | | `image.tag` | Can be set to overwrite the global tag, which should be used in that chart. | `` |
 | | `image.pullSecrets` | Can be set to overwrite the global.image.pullSecrets | `{{ global.image.pullSecrets }}` |
 | | `sidecars` | Can be used to deploy extra containers in the same pod | `[]` |
+| | `initContainers` | Can be used to set up extra init containers for the taskList pods, useful for adding interceptors | `[ ]` |
 | | `contextPath` |  Can be used to make Tasklist web application works on a custom sub-path. This is mainly used to run Camunda Platform web applications under a single domain. | |
 | | `podAnnotations` | Can be used to define extra Tasklist pod annotations | `{ }` |
 | | `podLabels` |  Can be used to define extra Tasklist pod labels | `{ }` |
@@ -621,6 +625,7 @@ For more information, visit [Optimize Introduction](https://docs.camunda.io/opti
 | | `partitionCount` |  Defines how many Zeebe partitions are set up in the cluster and which should be imported by Optimize | `"3"` |
 | | `env` |  Can be used to set extra environment variables in each Optimize container. Environment variables listed here may appear twice in `kubectl describe` but the variable listed in this option will have precedence. | `[]` |
 | | `command` | Can be used to [override the default command provided by the container image](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/) | `[]` |
+| | `initContainers` | Can be used to set up extra init containers for the optimize pods, useful for adding interceptors | `[ ]` |
 | | `extraVolumes` |  Can be used to define extra volumes for the Optimize pods, useful for tls and self-signed certificates | `[]` |
 | | `extraVolumeMounts` |  Can be used to mount extra volumes for the Optimize pods, useful for tls and self-signed certificates | `[]` |
 | | `serviceAccount` |  Configuration for the service account where the Optimize pods are assigned to | |
@@ -694,6 +699,7 @@ For more information, visit [Identity Overview](https://docs.camunda.io/docs/sel
 | | `image.tag` |   Can be set to overwrite the global.image.tag | `` |
 | | `image.pullSecrets` | Can be set to overwrite the global.image.pullSecrets | `{{ global.image.pullSecrets }}` |
 | | `sidecars` | Can be used to deploy extra containers in the same pod | `[]` |
+| | `initContainers` | Can be used to set up extra init containers for the identity pods, useful for adding interceptors | `[ ]` |
 | | `fullURL` |  Can be used when Ingress is configured (for both multi and single domain setup). <br/> Note: If the `ContextPath` is configured, then value of `ContextPath` should be included in the fullURL too. | |
 | | `contextPath` |  Can be used to make Identity web application works on a custom sub-path. This is mainly used to run Camunda Platform web applications under a single domain. **Note:** Identity cannot be accessed over HTTP if a "contextPath" is configured. Which means that Identity cannot be configured in combined Ingress without HTTPS. To use Identity over HTTP, setup a separated Ingress using "identity.ingress" and don't set "contextPath". | `` |
 | | `podAnnotations` | Can be used to define extra Identity pod annotations | `{ }` |
@@ -797,6 +803,7 @@ The SMTP connection can be configured with the values under `restapi.mail`.
 | | `restapi` | Configuration of the Web Modeler restapi component | |
 | | `restapi.image` | Configuration of the restapi Docker image | |
 | | `restapi.image.repository` | Defines which image repository to use for the restapi Docker image | `web-modeler-ee/modeler-restapi` |
+| | `restapi.initContainers` | Can be used to set up extra init containers | `[]` |
 | | `restapi.sidecars` | Can be used to deploy extra containers in the same pod | `[]` |
 | | `restapi.externalDatabase` | Can be used to configure a connection to an external database. This will only be applied if the postgresql dependency chart is disabled (by setting `postgresql.enabled` to `false`).<br/>Note: Currently, the only supported database system is PostgreSQL.| |
 | | `restapi.externalDatabase.host` | Defines the host name of the database instance | |
@@ -857,6 +864,7 @@ The SMTP connection can be configured with the values under `restapi.mail`.
 | | `webapp.image` | Configuration of the webapp Docker image | |
 | | `webapp.image.repository` | Defines which image repository to use for the webapp Docker image | `web-modeler-ee/modeler-webapp` |
 | | `webapp.sidecars` | Can be used to deploy extra containers in the same pod | `[]` |
+| | `webapp.initContainers` | Can be used to set up extra init containers | `[]` |
 | | `webapp.podAnnotations` | Can be used to define extra webapp pod annotations | `{}` |
 | | `webapp.podLabels` | Can be used to define extra webapp pod labels | `{}` |
 | | `webapp.env` | Can be used to set extra environment variables in each webapp container. Environment variables listed here may appear twice in `kubectl describe` but the variable listed in this option will have precedence. | `[]` |
@@ -901,6 +909,7 @@ The SMTP connection can be configured with the values under `restapi.mail`.
 | | `websockets.image` | Configuration of the websockets Docker image | |
 | | `websockets.image.repository` | Defines which image repository to use for the websockets Docker image | `web-modeler-ee/modeler-websockets` |
 | | `websockets.sidecars` | Can be used to deploy extra containers in the same pod | `[]` |
+| | `websockets.initContainers` | Can be used to set up extra init containers | `[]` |
 | | `websockets.publicHost` | Can be used to define the host on which the WebSockets server can be reached from the Web Modeler client in the browser. The default value assumes that a port-forwarding to the websockets service has been created.<br/>Note: The host will only be used if the Ingress resource for Web Modeler is disabled. | `localhost` |
 | | `websockets.publicPort` | Can be used to define the port number on which the WebSockets server can be reached from the Web Modeler client in the browser. The default value assumes that a port-forwarding to the websockets service on port `8085` has been created.<br/>Note: The port will only be used if the Ingress resource for Web Modeler is disabled. | `8085` |
 | | `websockets.podAnnotations` | Can be used to define extra websockets pod annotations | `{}` |
@@ -996,6 +1005,7 @@ For more information, visit [Introduction to Connectors](https://docs.camunda.io
 |              | `env`                                | Can be used to set extra environment variables in each Connectors container. Environment variables listed here may appear twice in `kubectl describe` but the variable listed in this option will have precedence.                                                                                                                                                      | `[]`                                                                                                  |
 |              | `extraVolumes`                       | Can be used to define extra volumes for the Connectors pods, useful for TLS and self-signed certificates                                                                                                                                          | `[]`                                                                                                  |
 |              | `extraVolumeMounts`                  | Can be used to mount extra volumes for the Connectors pods, useful for TLS and self-signed certificates                                                                                                                                           | `[]`                                                                                                  |
+|              | `initContainers`                     | Can be used to set up extra init containers for the identity pods, useful for adding interceptors                                                                                                                                                 | `[]`                                                                                                  |
 |              | `command`                            | Can be used to [override the default command provided by the container image](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/)                                                                        | `[]`                                                                                                  |
 |              | `serviceAccount`                     | Configuration for the service account where the Connectors pods are assigned to                                                                                                                                                                   |                                                                                                       |
 |              | `serviceAccount.enabled`             | If true, enables the Connectors service account                                                                                                                                                                                                   | `true`                                                                                                |
diff --git a/charts/camunda-platform/charts/identity/templates/deployment.yaml b/charts/camunda-platform/charts/identity/templates/deployment.yaml
index a55ad402..59da806e 100644
--- a/charts/camunda-platform/charts/identity/templates/deployment.yaml
+++ b/charts/camunda-platform/charts/identity/templates/deployment.yaml
@@ -22,6 +22,8 @@ spec:
     spec:
       imagePullSecrets:
         {{- include "camundaPlatform.imagePullSecrets" . | nindent 8 }}
+      initContainers:
+        {{- tpl (.Values.initContainers | default list | toYaml | nindent 8) $ }}
       containers:
       - name: {{ .Chart.Name }}
         image: {{ include "camundaPlatform.image" . | quote }}
diff --git a/charts/camunda-platform/charts/operate/templates/deployment.yaml b/charts/camunda-platform/charts/operate/templates/deployment.yaml
index 2b513a53..67ee963a 100644
--- a/charts/camunda-platform/charts/operate/templates/deployment.yaml
+++ b/charts/camunda-platform/charts/operate/templates/deployment.yaml
@@ -22,6 +22,8 @@ spec:
     spec:
       imagePullSecrets:
         {{- include "camundaPlatform.imagePullSecrets" . | nindent 8 }}
+      initContainers:
+        {{- tpl (.Values.initContainers | default list | toYaml | nindent 8) $ }}
       containers:
       - name: {{ .Chart.Name }}
         image: {{ include "camundaPlatform.image" . | quote }}
diff --git a/charts/camunda-platform/charts/optimize/templates/deployment.yaml b/charts/camunda-platform/charts/optimize/templates/deployment.yaml
index b886c40d..9171b850 100644
--- a/charts/camunda-platform/charts/optimize/templates/deployment.yaml
+++ b/charts/camunda-platform/charts/optimize/templates/deployment.yaml
@@ -23,6 +23,8 @@ spec:
     spec:
       imagePullSecrets:
         {{- include "camundaPlatform.imagePullSecrets" . | nindent 8 }}
+      initContainers:
+        {{- tpl (.Values.initContainers | default list | toYaml | nindent 8) $ }}
       containers:
       - name: {{ .Chart.Name }}
         image: {{ include "camundaPlatform.image" . | quote }}
diff --git a/charts/camunda-platform/charts/tasklist/templates/deployment.yaml b/charts/camunda-platform/charts/tasklist/templates/deployment.yaml
index 6f53df22..e42d9481 100644
--- a/charts/camunda-platform/charts/tasklist/templates/deployment.yaml
+++ b/charts/camunda-platform/charts/tasklist/templates/deployment.yaml
@@ -23,6 +23,8 @@ spec:
     spec:
       imagePullSecrets:
         {{- include "camundaPlatform.imagePullSecrets" . | nindent 8 }}
+      initContainers:
+        {{- tpl (.Values.initContainers | default list | toYaml | nindent 8) $ }}
       containers:
       - name: {{ .Chart.Name }}
         image: {{ include "camundaPlatform.image" . | quote }}
diff --git a/charts/camunda-platform/charts/zeebe-gateway/templates/gateway-deployment.yaml b/charts/camunda-platform/charts/zeebe-gateway/templates/gateway-deployment.yaml
index a9c79569..d7e8c145 100644
--- a/charts/camunda-platform/charts/zeebe-gateway/templates/gateway-deployment.yaml
+++ b/charts/camunda-platform/charts/zeebe-gateway/templates/gateway-deployment.yaml
@@ -25,12 +25,8 @@ spec:
       {{- end }}
       imagePullSecrets:
         {{- include "camundaPlatform.imagePullSecrets" . | nindent 8 }}
-      {{- if .Values.extraInitContainers }}
       initContainers:
-        {{- with .Values.extraInitContainers }}
-          {{- tpl (toYaml . ) $ | nindent 8 }}
-        {{- end }}
-      {{- end }}
+        {{- tpl ((coalesce .Values.initContainers .Values.extraInitContainers) | default list | toYaml | nindent 8) $ }}
       containers:
         - name: {{ .Chart.Name }}
           image: {{ include "camundaPlatform.image" . | quote }}
diff --git a/charts/camunda-platform/charts/zeebe/templates/statefulset.yaml b/charts/camunda-platform/charts/zeebe/templates/statefulset.yaml
index ad757f80..366d8ac8 100644
--- a/charts/camunda-platform/charts/zeebe/templates/statefulset.yaml
+++ b/charts/camunda-platform/charts/zeebe/templates/statefulset.yaml
@@ -34,9 +34,7 @@ spec:
       imagePullSecrets:
         {{- include "camundaPlatform.imagePullSecrets" . | nindent 8 }}
       initContainers:
-        {{- with .Values.extraInitContainers }}
-        {{- tpl (toYaml . ) $ | nindent 8  }}
-        {{- end }}
+        {{- tpl ((coalesce .Values.initContainers .Values.extraInitContainers) | default list | toYaml | nindent 8) $ }}
       containers:
       - name: {{ .Chart.Name }}
         image: {{ include "camundaPlatform.image" . | quote }}
diff --git a/charts/camunda-platform/templates/connectors/deployment.yaml b/charts/camunda-platform/templates/connectors/deployment.yaml
index c60640c3..c178eb9d 100644
--- a/charts/camunda-platform/templates/connectors/deployment.yaml
+++ b/charts/camunda-platform/templates/connectors/deployment.yaml
@@ -21,6 +21,8 @@ spec:
       {{- end }}
     spec:
       imagePullSecrets: {{- include "connectors.imagePullSecrets" . | nindent 8 }}
+      initContainers:
+        {{- tpl (.Values.connectors.initContainers | default list | toYaml | nindent 8) $ }}
       containers:
         - name: connectors
           image: {{ include "camundaPlatform.imageByParams" (dict "base" .Values.global "overlay" .Values.connectors) }}
diff --git a/charts/camunda-platform/templates/web-modeler/deployment-restapi.yaml b/charts/camunda-platform/templates/web-modeler/deployment-restapi.yaml
index 4b8ebfad..99a8d15a 100644
--- a/charts/camunda-platform/templates/web-modeler/deployment-restapi.yaml
+++ b/charts/camunda-platform/templates/web-modeler/deployment-restapi.yaml
@@ -22,6 +22,8 @@ spec:
     spec:
       imagePullSecrets:
         {{- include "webModeler.imagePullSecrets" . | nindent 8 }}
+      initContainers:
+        {{- tpl (.Values.webModeler.restapi.initContainers | default list | toYaml | nindent 8) $ }}
       containers:
       - name: {{ include "webModeler.name" . }}-restapi
         image: {{ include "webModeler.restapi.image" . | quote }}
diff --git a/charts/camunda-platform/templates/web-modeler/deployment-webapp.yaml b/charts/camunda-platform/templates/web-modeler/deployment-webapp.yaml
index 82811a64..f291fbe9 100644
--- a/charts/camunda-platform/templates/web-modeler/deployment-webapp.yaml
+++ b/charts/camunda-platform/templates/web-modeler/deployment-webapp.yaml
@@ -22,6 +22,8 @@ spec:
     spec:
       imagePullSecrets:
         {{- include "webModeler.imagePullSecrets" . | nindent 8 }}
+      initContainers:
+        {{- tpl (.Values.webModeler.webapp.initContainers | default list | toYaml | nindent 8) $ }}
       containers:
       - name: {{ include "webModeler.name" . }}-webapp
         image: {{ include "webModeler.webapp.image" . | quote }}
diff --git a/charts/camunda-platform/templates/web-modeler/deployment-websockets.yaml b/charts/camunda-platform/templates/web-modeler/deployment-websockets.yaml
index b9a7d371..ec80ac13 100644
--- a/charts/camunda-platform/templates/web-modeler/deployment-websockets.yaml
+++ b/charts/camunda-platform/templates/web-modeler/deployment-websockets.yaml
@@ -22,6 +22,8 @@ spec:
     spec:
       imagePullSecrets:
         {{- include "webModeler.imagePullSecrets" . | nindent 8 }}
+      initContainers:
+        {{- tpl (.Values.webModeler.websockets.initContainers | default list | toYaml | nindent 8) $ }}
       containers:
       - name: {{ include "webModeler.name" . }}-websockets
         image: {{ include "webModeler.websockets.image" . | quote }}
diff --git a/charts/camunda-platform/values.yaml b/charts/camunda-platform/values.yaml
index df9d5b86..b57310a0 100644
--- a/charts/camunda-platform/values.yaml
+++ b/charts/camunda-platform/values.yaml
@@ -310,8 +310,10 @@ zeebe:
   extraVolumes: []
   # ExtraVolumeMounts can be used to mount extra volumes for the broker pods, useful for additional exporters
   extraVolumeMounts: []
-  # ExtraInitContainers can be used to set up extra init containers for the broker pods, useful for additional exporters
+  # (Deprecated - use `initContainers` instead) ExtraInitContainers can be used to set up extra init containers for the broker pods, useful for additional exporters
   extraInitContainers: []
+ # initContainers can be used to set up extra init containers for the broker pods, useful for additional exporters
+  initContainers: []
 
   # PodAnnotations can be used to define extra broker pod annotations
   podAnnotations: {}
@@ -572,8 +574,10 @@ zeebe-gateway:
   extraVolumeMounts: []
   # ExtraVolumes can be used to define extra volumes for the gateway pods, useful for enabling tls between gateway and broker
   extraVolumes: []
-  # ExtraInitContainers can be used to set up extra init containers for the gateway pods, useful for adding interceptors
+  # (Deprecated - use `initContainers` instead) ExtraInitContainers can be used to set up extra init containers for the gateway pods, useful for adding interceptors
   extraInitContainers: []
+  # initContainers can be used to set up extra init containers for the gateway pods, useful for adding interceptors
+  initContainers: []
 
   # Service configuration for the gateway service
   service:
@@ -659,7 +663,8 @@ operate:
 
   # Sidecars can be used to attach extra containers to the operate deployment
   sidecars: []
-
+  # initContainers can be used to set up extra init containers for the operate pods, useful for additional exporters
+  initContainers: []
   # ContextPath can be used to make Operate web application works on a custom sub-path. This is mainly used to run Camunda Platform web applications under a single domain.
   # contextPath: "/operate"
 
@@ -839,7 +844,8 @@ tasklist:
 
   # Sidecars can be used to attach extra containers to the tasklist deployment
   sidecars: []
-
+  # initContainers can be used to set up extra init containers for the taskList pods, useful for additional exporters
+  initContainers: []
   # ContextPath can be used to make Tasklist web application works on a custom sub-path. This is mainly used to run Camunda Platform web applications under a single domain.
   # contextPath: "/tasklist"
 
@@ -1036,7 +1042,8 @@ optimize:
   extraVolumes: []
   # ExtraVolumeMounts can be used to mount extra volumes for the Optimize pods, useful for tls and self-signed certificates
   extraVolumeMounts: []
-
+  # initContainers can be used to set up extra init containers for the optimize pods, useful for additional exporters
+  initContainers: []
   # ServiceAccount configuration for the service account where the Optimize pods are assigned to
   serviceAccount:
     # ServiceAccount.enabled if true, enables the Optimize service account
@@ -1220,7 +1227,8 @@ identity:
 
   # Sidecars can be used to attach extra containers to the identity deployment
   sidecars: []
-
+  # initContainers can be used to set up extra init containers for the identity pods, useful for additional exporters
+  initContainers: []
   # FullURL can be used when Ingress is configured (for both multi and single domain setup).
   # Note: If the `ContextPath` is configured, then value of `ContextPath` should be included in the URL too.
   # fullURL: "https://camunda.example.com/identity"
@@ -1519,6 +1527,8 @@ webModeler:
 
     # Restapi.sidecars can be used to attach extra containers to the restapi deployment
     sidecars: []
+    # Restapi.initContainers can be used to set up extra init containers to the restapi deployment
+    initContainers: []
 
     # Restapi.externalDatabase can be used to configure a connection to an external database. This will only be applied
     # if the postgresql dependency chart is disabled (by setting postgresql.enabled to false).
@@ -1673,6 +1683,8 @@ webModeler:
 
     # Webapp.sidecars can be used to attach extra containers to the modeler webapp deployment
     sidecars: []
+    # Webapp.initContainers can be used to set up extra init containers to the modeler webapp deployment
+    initContainers: []
 
     # Webapp.podAnnotations can be used to define extra webapp pod annotations
     podAnnotations: {}
@@ -1794,6 +1806,8 @@ webModeler:
 
     # Websockets.sidecars can be used to attach extra containers to the modeler websockets deployment
     sidecars: []
+    # Websockets.initContainers can be used to set up extra init containers to the modeler websockets deployment
+    initContainers: []
 
     # Websockets.publicHost can be used to define the host on which the WebSockets server can be reached from the Web Modeler client in the browser.
     # The default value assumes that a port-forwarding to the websockets service has been created.
@@ -1999,6 +2013,8 @@ connectors:
 
   # Sidecars can be used to attach extra containers to the connectors deployment
   sidecars: []
+  # initContainers can be used to set up extra init containers to the connectors deployment
+  initContainers: []
 
   # Number of Connectors replicas
   replicas: 1
diff --git a/go.mod b/go.mod
index f3c3532f..bd9fc4ef 100644
--- a/go.mod
+++ b/go.mod
@@ -1,14 +1,14 @@
 module camunda-platform-helm
 
-go 1.19
+go 1.21.1
 
 require (
-	github.com/gruntwork-io/terratest v0.43.13
+	github.com/gruntwork-io/terratest v0.44.0
 	github.com/stretchr/testify v1.8.4
-	k8s.io/api v0.27.5
+	k8s.io/api v0.27.6
 )
 
-require k8s.io/apimachinery v0.27.5 // indirect
+require k8s.io/apimachinery v0.27.6 // indirect
 
 require (
 	github.com/aws/aws-sdk-go v1.44.122 // indirect
diff --git a/go.sum b/go.sum
index e78c05d1..586a0b97 100644
--- a/go.sum
+++ b/go.sum
@@ -171,6 +171,8 @@ github.com/gruntwork-io/terratest v0.43.12 h1:e1SgJe/JF3zh1k/7BDMv7sF3wTKqkSYNx7
 github.com/gruntwork-io/terratest v0.43.12/go.mod h1:Tw+6/fcJFiBPpsx9NNSkLG5oHKIeaqiJHVLpQ+ORIfQ=
 github.com/gruntwork-io/terratest v0.43.13 h1:/d0UeDj/FJM66VRP/3JA4mTw0z7BOm9ntHYfrTjIpY8=
 github.com/gruntwork-io/terratest v0.43.13/go.mod h1:Tw+6/fcJFiBPpsx9NNSkLG5oHKIeaqiJHVLpQ+ORIfQ=
+github.com/gruntwork-io/terratest v0.44.0 h1:3k7lglJFAtw77p2HnR5vaZBCBnlHmu3DuLjVyuCZXJ0=
+github.com/gruntwork-io/terratest v0.44.0/go.mod h1:EAEuzSjvxAzQoJCEQ06bJPTmdC9HikzgvhmxnAYuExM=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -571,12 +573,16 @@ k8s.io/api v0.27.2 h1:+H17AJpUMvl+clT+BPnKf0E3ksMAzoBBg7CntpSuADo=
 k8s.io/api v0.27.2/go.mod h1:ENmbocXfBT2ADujUXcBhHV55RIT31IIEvkntP6vZKS4=
 k8s.io/api v0.27.5 h1:49hIzqJNSuOQpA53MMihgAS4YDcQitTy58B9PMFthLc=
 k8s.io/api v0.27.5/go.mod h1:zjBZB+c0KDU55Wxb9Bob9WZGxu9zdKHitzHxBtaIVoA=
+k8s.io/api v0.27.6 h1:PBWu/lywJe2qQcshMjubzcBg7+XDZOo7O8JJAWuYtUo=
+k8s.io/api v0.27.6/go.mod h1:AQYj0UsFCp3qJE7bOVnUuy4orCsXVkvHefnbYQiNWgk=
 k8s.io/apimachinery v0.26.4 h1:rZccKdBLg9vP6J09JD+z8Yr99Ce8gk3Lbi9TCx05Jzs=
 k8s.io/apimachinery v0.26.4/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I=
 k8s.io/apimachinery v0.27.2 h1:vBjGaKKieaIreI+oQwELalVG4d8f3YAMNpWLzDXkxeg=
 k8s.io/apimachinery v0.27.2/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
 k8s.io/apimachinery v0.27.5 h1:6Q5HBXYJJPisd6yDVAprLe6FQsmw7a7Cu69dcrpQET8=
 k8s.io/apimachinery v0.27.5/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
+k8s.io/apimachinery v0.27.6 h1:mGU8jmBq5o8mWBov+mLjdTBcU+etTE19waies4AQ6NE=
+k8s.io/apimachinery v0.27.6/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
 k8s.io/client-go v0.26.0 h1:lT1D3OfO+wIi9UFolCrifbjUUgu7CpLca0AD8ghRLI8=
 k8s.io/client-go v0.26.0/go.mod h1:I2Sh57A79EQsDmn7F7ASpmru1cceh3ocVT9KlX2jEZg=
 k8s.io/client-go v0.27.2 h1:vDLSeuYvCHKeoQRhCXjxXO45nHVv2Ip4Fe0MfioMrhE=


Test patch:
diff --git a/charts/camunda-platform/test/unit/connectors/deployment_test.go b/charts/camunda-platform/test/unit/connectors/deployment_test.go
index fdf54857..66852b9c 100644
--- a/charts/camunda-platform/test/unit/connectors/deployment_test.go
+++ b/charts/camunda-platform/test/unit/connectors/deployment_test.go
@@ -600,7 +600,7 @@ func (s *deploymentTemplateTest) TestContainerProbesWithContextPath() {
 			"connectors.livenessProbe.probePath":  "/live",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -772,7 +772,7 @@ func (s *deploymentTemplateTest) TestContainerSetInboundModeOauth() {
 	s.Require().Contains(env, corev1.EnvVar{Name: "CAMUNDA_OPERATE_CLIENT_CLIENT-ID", Value: "connectors"})
 	s.Require().Contains(env, corev1.EnvVar{Name: "CAMUNDA_OPERATE_CLIENT_KEYCLOAK-REALM", Value: "camunda-platform"})
 	s.Require().Contains(env, corev1.EnvVar{Name: "CAMUNDA_OPERATE_CLIENT_URL", Value: "http://camunda-platform-test-operate:80"})
-	
+
 }
 
 func (s *deploymentTemplateTest) TestContainerSetContextPath() {
@@ -826,3 +826,33 @@ func (s *deploymentTemplateTest) TestContainerSetSidecar() {
 
 	s.Require().Contains(podContainers, expectedContainer)
 }
+func (s *deploymentTemplateTest) TestContainerSetInitContainer() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"connectors.initContainers[0].name":                   "nginx",
+			"connectors.initContainers[0].image":                  "nginx:latest",
+			"connectors.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var deployment appsv1.Deployment
+	helm.UnmarshalK8SYaml(s.T(), output, &deployment)
+
+	// then
+	podContainers := deployment.Spec.Template.Spec.InitContainers
+	expectedContainer := corev1.Container{
+		Name:  "nginx",
+		Image: "nginx:latest",
+		Ports: []corev1.ContainerPort{
+			{
+				ContainerPort: 80,
+			},
+		},
+	}
+
+	s.Require().Contains(podContainers, expectedContainer)
+}
diff --git a/charts/camunda-platform/test/unit/connectors/golden/deployment.golden.yaml b/charts/camunda-platform/test/unit/connectors/golden/deployment.golden.yaml
index e5b5b10a..ac29eb23 100644
--- a/charts/camunda-platform/test/unit/connectors/golden/deployment.golden.yaml
+++ b/charts/camunda-platform/test/unit/connectors/golden/deployment.golden.yaml
@@ -37,6 +37,8 @@ spec:
     spec:
       imagePullSecrets:
         []
+      initContainers:
+        []
       containers:
         - name: connectors
           image: camunda/connectors-bundle:0.23.0
diff --git a/charts/camunda-platform/test/unit/global_deployment_test.go b/charts/camunda-platform/test/unit/global_deployment_test.go
index e761bee9..630a6358 100644
--- a/charts/camunda-platform/test/unit/global_deployment_test.go
+++ b/charts/camunda-platform/test/unit/global_deployment_test.go
@@ -54,7 +54,7 @@ func (s *deploymentTemplateTest) TestContainerShouldNotRenderOptimizeIfDisabled(
 			"optimize.enabled": "false",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -71,7 +71,7 @@ func (s *deploymentTemplateTest) TestContainerShouldNotRenderOperateIfDisabled()
 			"operate.enabled": "false",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -88,7 +88,7 @@ func (s *deploymentTemplateTest) TestContainerShouldNotRenderTasklistIfDisabled(
 			"tasklist.enabled": "false",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -106,7 +106,7 @@ func (s *deploymentTemplateTest) TestContainerShouldNotRenderIdentityIfDisabled(
 			"global.identity.auth.enabled": "false",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -123,7 +123,7 @@ func (s *deploymentTemplateTest) TestContainerShouldNotRenderWebModelerIfDisable
 			"webModeler.enabled": "false",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
diff --git a/charts/camunda-platform/test/unit/golden/keycloak-statefulset.golden.yaml b/charts/camunda-platform/test/unit/golden/keycloak-statefulset.golden.yaml
index ee57eb1e..adc25907 100644
--- a/charts/camunda-platform/test/unit/golden/keycloak-statefulset.golden.yaml
+++ b/charts/camunda-platform/test/unit/golden/keycloak-statefulset.golden.yaml
@@ -9,6 +9,7 @@ metadata:
     app.kubernetes.io/name: keycloak
     app.kubernetes.io/instance: camunda-platform-test
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/version: "20.0.1"
     app.kubernetes.io/component: keycloak
 spec:
   replicas: 1
@@ -29,6 +30,7 @@ spec:
         app.kubernetes.io/name: keycloak
         app.kubernetes.io/instance: camunda-platform-test
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/version: "20.0.1"
         app.kubernetes.io/component: keycloak
     spec:
       serviceAccountName: camunda-platform-test-keycloak
diff --git a/charts/camunda-platform/test/unit/identity/deployment_test.go b/charts/camunda-platform/test/unit/identity/deployment_test.go
index a1224ea6..dcc82f5f 100644
--- a/charts/camunda-platform/test/unit/identity/deployment_test.go
+++ b/charts/camunda-platform/test/unit/identity/deployment_test.go
@@ -63,7 +63,7 @@ func (s *deploymentTemplateTest) TestContainerWithExternalKeycloak() {
 			"global.identity.keycloak.auth.existingSecretKey": "test-admin",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -360,7 +360,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumesAndMounts() {
 			"identity.extraVolumes[0].configMap.defaultMode": "744",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -578,7 +578,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetTemplateEnvVars() {
 			"identity.env[1].value": "nothingToSeeHere",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -601,7 +601,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetCorrectSecret() {
 			"identity.keycloak.auth.passwordSecretKey": "test-admin",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -630,7 +630,7 @@ func (s *deploymentTemplateTest) TestContainerShouldDisableIntegration() {
 			"global.identity.auth.enabled": "false",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -656,7 +656,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOperateIdentitySecretValu
 			"global.identity.auth.operate.existingSecret": "secretValue",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -685,7 +685,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOperateIdentitySecretViaR
 			"global.identity.auth.operate.existingSecret.name": "ownExistingSecret",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -714,7 +714,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetTasklistIdentitySecretVal
 			"global.identity.auth.tasklist.existingSecret": "secretValue",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -743,7 +743,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetTasklistIdentitySecretVia
 			"global.identity.auth.tasklist.existingSecret.name": "ownExistingSecret",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -772,7 +772,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOptimizeIdentitySecretVal
 			"global.identity.auth.optimize.existingSecret": "secretValue",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -801,7 +801,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOptimizeIdentitySecretVia
 			"global.identity.auth.optimize.existingSecret.name": "ownExistingSecret",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -853,7 +853,7 @@ func (s *deploymentTemplateTest) TestContainerShouldAddContextPath() {
 			"identity.contextPath": "/identity",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -892,7 +892,7 @@ func (s *deploymentTemplateTest) TestContainerStartupProbe() {
 			"identity.startupProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -924,7 +924,7 @@ func (s *deploymentTemplateTest) TestContainerLivenessProbe() {
 			"identity.livenessProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -957,7 +957,7 @@ func (s *deploymentTemplateTest) TestContainerProbesWithContextPath() {
 			"identity.livenessProbe.probePath":  "/live",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -1004,6 +1004,37 @@ func (s *deploymentTemplateTest) TestContainerSetSidecar() {
 	s.Require().Contains(podContainers, expectedContainer)
 }
 
+func (s *deploymentTemplateTest) TestInitContainers() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"identity.initContainers[0].name":                   "nginx",
+			"identity.initContainers[0].image":                  "nginx:latest",
+			"identity.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var deployment appsv1.Deployment
+	helm.UnmarshalK8SYaml(s.T(), output, &deployment)
+
+	// then
+	podContainers := deployment.Spec.Template.Spec.InitContainers
+	expectedContainer := corev1.Container{
+		Name:  "nginx",
+		Image: "nginx:latest",
+		Ports: []corev1.ContainerPort{
+			{
+				ContainerPort: 80,
+			},
+		},
+	}
+
+	s.Require().Contains(podContainers, expectedContainer)
+}
+
 func (s *deploymentTemplateTest) TestContainerShouldSetFirstUserExistingSecretValue() {
 	// given
 	options := &helm.Options{
@@ -1011,7 +1042,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetFirstUserExistingSecretVa
 			"identity.firstUser.existingSecret": "identityFirstUserSecret",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
diff --git a/charts/camunda-platform/test/unit/identity/golden/deployment.golden.yaml b/charts/camunda-platform/test/unit/identity/golden/deployment.golden.yaml
index 94340a07..f26a7bdf 100644
--- a/charts/camunda-platform/test/unit/identity/golden/deployment.golden.yaml
+++ b/charts/camunda-platform/test/unit/identity/golden/deployment.golden.yaml
@@ -37,6 +37,8 @@ spec:
     spec:
       imagePullSecrets:
         []
+      initContainers:
+        []
       containers:
       - name: identity
         image: "camunda/identity:8.2.13"
diff --git a/charts/camunda-platform/test/unit/ingress_test.go b/charts/camunda-platform/test/unit/ingress_test.go
index ef5a217a..dd51b03d 100644
--- a/charts/camunda-platform/test/unit/ingress_test.go
+++ b/charts/camunda-platform/test/unit/ingress_test.go
@@ -61,7 +61,7 @@ func (s *ingressTemplateTest) TestIngressEnabledAndKeycloakChartProxyForwardingE
 			"identity.keycloak.enabled":  "true",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// NOTE: helm.Options.ExtraArgs doesn't support passing args to Helm "template" command.
@@ -94,7 +94,7 @@ func (s *ingressTemplateTest) TestIngressEnabledWithKeycloakCustomContextPath()
 			"identity.contextPath":                 "/identity",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -138,7 +138,7 @@ func (s *ingressTemplateTest) TestIngressWithKeycloakChartIsDisabled() {
 			"global.identity.keycloak.url.port":     "8443",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -165,7 +165,7 @@ func (s *ingressTemplateTest) TestIngressWithContextPath() {
 			"webModeler.contextPath":              "/modeler",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -196,7 +196,7 @@ func (s *ingressTemplateTest) TestIngressComponentWithNoContextPath() {
 			"webModeler.contextPath":              "",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -223,7 +223,7 @@ func (s *ingressTemplateTest) TestIngressComponentDisabled() {
 			"webModeler.enabled":     "false",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
diff --git a/charts/camunda-platform/test/unit/operate/deployment_test.go b/charts/camunda-platform/test/unit/operate/deployment_test.go
index abc1dbc4..600b3af9 100644
--- a/charts/camunda-platform/test/unit/operate/deployment_test.go
+++ b/charts/camunda-platform/test/unit/operate/deployment_test.go
@@ -173,7 +173,7 @@ func (s *deploymentTemplateTest) TestContainerOverwriteImageTag() {
 			"operate.image.tag": "a.b.c",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -195,7 +195,7 @@ func (s *deploymentTemplateTest) TestContainerOverwriteGlobalImageTag() {
 			"global.image.tag": "a.b.c",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -218,7 +218,7 @@ func (s *deploymentTemplateTest) TestContainerOverwriteImageTagWithChartDirectSe
 			"operate.image.tag": "a.b.c",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -240,7 +240,7 @@ func (s *deploymentTemplateTest) TestContainerSetContainerCommand() {
 			"operate.command": "[printenv]",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -264,7 +264,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumes() {
 			"operate.extraVolumes[0].configMap.defaultMode": "744",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -291,7 +291,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumeMounts() {
 			"operate.extraVolumeMounts[0].mountPath": "/usr/local/config",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -321,7 +321,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumesAndMounts() {
 			"operate.extraVolumes[0].configMap.defaultMode": "744",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -356,7 +356,7 @@ func (s *deploymentTemplateTest) TestContainerSetServiceAccountName() {
 			"operate.serviceAccount.name": "accName",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -537,7 +537,7 @@ func (s *deploymentTemplateTest) TestContainerShouldDisableOperateIntegration()
 			"global.identity.auth.enabled": "false",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -565,7 +565,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOperateIdentitySecretValu
 			"global.identity.auth.operate.existingSecret": "secretValue",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -594,7 +594,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOperateIdentitySecretViaR
 			"global.identity.auth.operate.existingSecret.name": "ownExistingSecret",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -625,7 +625,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetTheRightKeycloakServiceUr
 			"global.identity.keycloak.url.port":     "80",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -671,7 +671,7 @@ func (s *deploymentTemplateTest) TestContainerShouldAddContextPath() {
 			"operate.contextPath": "/operate",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -704,7 +704,7 @@ func (s *deploymentTemplateTest) TestContainerStartupProbe() {
 			"operate.startupProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -736,7 +736,7 @@ func (s *deploymentTemplateTest) TestContainerLivenessProbe() {
 			"operate.livenessProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -768,7 +768,7 @@ func (s *deploymentTemplateTest) TestContainerProbesWithContextPath() {
 			"operate.livenessProbe.probePath":  "/live",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -814,3 +814,34 @@ func (s *deploymentTemplateTest) TestContainerSetSidecar() {
 
 	s.Require().Contains(podContainers, expectedContainer)
 }
+
+func (s *deploymentTemplateTest) TestInitContainers() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"operate.initContainers[0].name":                   "nginx",
+			"operate.initContainers[0].image":                  "nginx:latest",
+			"operate.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var deployment appsv1.Deployment
+	helm.UnmarshalK8SYaml(s.T(), output, &deployment)
+
+	// then
+	podContainers := deployment.Spec.Template.Spec.InitContainers
+	expectedContainer := corev1.Container{
+		Name:  "nginx",
+		Image: "nginx:latest",
+		Ports: []corev1.ContainerPort{
+			{
+				ContainerPort: 80,
+			},
+		},
+	}
+
+	s.Require().Contains(podContainers, expectedContainer)
+}
diff --git a/charts/camunda-platform/test/unit/operate/golden/deployment.golden.yaml b/charts/camunda-platform/test/unit/operate/golden/deployment.golden.yaml
index 62062702..2674859d 100644
--- a/charts/camunda-platform/test/unit/operate/golden/deployment.golden.yaml
+++ b/charts/camunda-platform/test/unit/operate/golden/deployment.golden.yaml
@@ -37,6 +37,8 @@ spec:
     spec:
       imagePullSecrets:
         []
+      initContainers:
+        []
       containers:
       - name: operate
         image: "camunda/operate:8.2.13"
diff --git a/charts/camunda-platform/test/unit/optimize/deployment_test.go b/charts/camunda-platform/test/unit/optimize/deployment_test.go
index 8f02bd40..a26520e2 100644
--- a/charts/camunda-platform/test/unit/optimize/deployment_test.go
+++ b/charts/camunda-platform/test/unit/optimize/deployment_test.go
@@ -173,7 +173,7 @@ func (s *deploymentTemplateTest) TestContainerOverwriteImageTag() {
 			"optimize.image.tag": "a.b.c",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -197,7 +197,7 @@ func (s *deploymentTemplateTest) TestContainerNotOverwriteGlobalImageTag() {
 			"global.image.tag": "a.b.c",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -220,7 +220,7 @@ func (s *deploymentTemplateTest) TestContainerOverwriteImageTagWithChartDirectSe
 			"optimize.image.tag": "a.b.c",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -242,7 +242,7 @@ func (s *deploymentTemplateTest) TestContainerSetContainerCommand() {
 			"optimize.command": "[printenv]",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -266,7 +266,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumes() {
 			"optimize.extraVolumes[0].configMap.defaultMode": "744",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -293,7 +293,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumeMounts() {
 			"optimize.extraVolumeMounts[0].mountPath": "/usr/local/config",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -323,7 +323,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumesAndMounts() {
 			"optimize.extraVolumes[0].configMap.defaultMode": "744",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -358,7 +358,7 @@ func (s *deploymentTemplateTest) TestContainerSetServiceAccountName() {
 			"optimize.serviceAccount.name": "accName",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -539,7 +539,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOptimizeIdentitySecretVal
 			"global.identity.auth.optimize.existingSecret": "secretValue",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -568,7 +568,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOptimizeIdentitySecretVia
 			"global.identity.auth.optimize.existingSecret.name": "ownExistingSecret",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -599,7 +599,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetTheRightKeycloakServiceUr
 			"global.identity.keycloak.url.port":     "80",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -645,7 +645,7 @@ func (s *deploymentTemplateTest) TestContainerShouldAddContextPath() {
 			"optimize.contextPath": "/optimize",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -678,7 +678,7 @@ func (s *deploymentTemplateTest) TestContainerStartupProbe() {
 			"optimize.startupProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -710,7 +710,7 @@ func (s *deploymentTemplateTest) TestContainerLivenessProbe() {
 			"optimize.livenessProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -742,7 +742,7 @@ func (s *deploymentTemplateTest) TestContainerProbesWithContextPath() {
 			"optimize.livenessProbe.probePath":  "/live",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -788,3 +788,34 @@ func (s *deploymentTemplateTest) TestContainerSetSidecar() {
 
 	s.Require().Contains(podContainers, expectedContainer)
 }
+
+func (s *deploymentTemplateTest) TestInitContainers() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"optimize.initContainers[0].name":                   "nginx",
+			"optimize.initContainers[0].image":                  "nginx:latest",
+			"optimize.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var deployment appsv1.Deployment
+	helm.UnmarshalK8SYaml(s.T(), output, &deployment)
+
+	// then
+	podContainers := deployment.Spec.Template.Spec.InitContainers
+	expectedContainer := corev1.Container{
+		Name:  "nginx",
+		Image: "nginx:latest",
+		Ports: []corev1.ContainerPort{
+			{
+				ContainerPort: 80,
+			},
+		},
+	}
+
+	s.Require().Contains(podContainers, expectedContainer)
+}
diff --git a/charts/camunda-platform/test/unit/optimize/golden/deployment.golden.yaml b/charts/camunda-platform/test/unit/optimize/golden/deployment.golden.yaml
index 2830adf6..55c716c6 100644
--- a/charts/camunda-platform/test/unit/optimize/golden/deployment.golden.yaml
+++ b/charts/camunda-platform/test/unit/optimize/golden/deployment.golden.yaml
@@ -37,6 +37,8 @@ spec:
     spec:
       imagePullSecrets:
         []
+      initContainers:
+        []
       containers:
       - name: optimize
         image: "camunda/optimize:3.10.5"
diff --git a/charts/camunda-platform/test/unit/tasklist/deployment_test.go b/charts/camunda-platform/test/unit/tasklist/deployment_test.go
index b96ffc82..0a75c136 100644
--- a/charts/camunda-platform/test/unit/tasklist/deployment_test.go
+++ b/charts/camunda-platform/test/unit/tasklist/deployment_test.go
@@ -237,7 +237,7 @@ func (s *deploymentTemplateTest) TestContainerSetServiceAccountName() {
 			"tasklist.serviceAccount.name": "accName",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -320,7 +320,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumes() {
 			"tasklist.extraVolumes[0].configMap.defaultMode": "744",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -347,7 +347,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumeMounts() {
 			"tasklist.extraVolumeMounts[0].mountPath": "/usr/local/config",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -377,7 +377,7 @@ func (s *deploymentTemplateTest) TestContainerSetExtraVolumesAndMounts() {
 			"tasklist.extraVolumes[0].configMap.defaultMode": "744",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -556,7 +556,7 @@ func (s *deploymentTemplateTest) TestContainerShouldDisableOperateIntegration()
 			"global.identity.auth.enabled": "false",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -584,7 +584,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOperateIdentitySecretValu
 			"global.identity.auth.tasklist.existingSecret": "secretValue",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -613,7 +613,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetOperateIdentitySecretViaR
 			"global.identity.auth.tasklist.existingSecret.name": "ownExistingSecret",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -645,7 +645,7 @@ func (s *deploymentTemplateTest) TestContainerShouldSetTheRightKeycloakServiceUr
 			"global.identity.keycloak.url.port":     "80",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -691,7 +691,7 @@ func (s *deploymentTemplateTest) TestContainerShouldAddContextPath() {
 			"tasklist.contextPath": "/tasklist",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -724,7 +724,7 @@ func (s *deploymentTemplateTest) TestContainerStartupProbe() {
 			"tasklist.startupProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -756,7 +756,7 @@ func (s *deploymentTemplateTest) TestContainerLivenessProbe() {
 			"tasklist.livenessProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -788,7 +788,7 @@ func (s *deploymentTemplateTest) TestContainerProbesWithContextPath() {
 			"tasklist.livenessProbe.probePath":  "/live",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -834,3 +834,34 @@ func (s *deploymentTemplateTest) TestContainerSetSidecar() {
 
 	s.Require().Contains(podContainers, expectedContainer)
 }
+
+func (s *deploymentTemplateTest) TestInitContainers() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"tasklist.initContainers[0].name":                   "nginx",
+			"tasklist.initContainers[0].image":                  "nginx:latest",
+			"tasklist.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var deployment appsv1.Deployment
+	helm.UnmarshalK8SYaml(s.T(), output, &deployment)
+
+	// then
+	podContainers := deployment.Spec.Template.Spec.InitContainers
+	expectedContainer := corev1.Container{
+		Name:  "nginx",
+		Image: "nginx:latest",
+		Ports: []corev1.ContainerPort{
+			{
+				ContainerPort: 80,
+			},
+		},
+	}
+
+	s.Require().Contains(podContainers, expectedContainer)
+}
diff --git a/charts/camunda-platform/test/unit/tasklist/golden/deployment.golden.yaml b/charts/camunda-platform/test/unit/tasklist/golden/deployment.golden.yaml
index 7b37753b..35107a2d 100644
--- a/charts/camunda-platform/test/unit/tasklist/golden/deployment.golden.yaml
+++ b/charts/camunda-platform/test/unit/tasklist/golden/deployment.golden.yaml
@@ -37,6 +37,8 @@ spec:
     spec:
       imagePullSecrets:
         []
+      initContainers:
+        []
       containers:
       - name: tasklist
         image: "camunda/tasklist:8.2.13"
diff --git a/charts/camunda-platform/test/unit/web-modeler/deployment_restapi_test.go b/charts/camunda-platform/test/unit/web-modeler/deployment_restapi_test.go
index 01aa9a0f..2d8f52f6 100644
--- a/charts/camunda-platform/test/unit/web-modeler/deployment_restapi_test.go
+++ b/charts/camunda-platform/test/unit/web-modeler/deployment_restapi_test.go
@@ -355,3 +355,36 @@ func (s *restapiDeploymentTemplateTest) TestContainerSetSidecar() {
 
 	s.Require().Contains(podContainers, expectedContainer)
 }
+
+func (s *restapiDeploymentTemplateTest) TestContainerSetInitContainer() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"webModeler.enabled":                                          "true",
+			"webModeler.restapi.mail.fromAddress":                         "example@example.com",
+			"webModeler.restapi.initContainers[0].name":                   "nginx",
+			"webModeler.restapi.initContainers[0].image":                  "nginx:latest",
+			"webModeler.restapi.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var deployment appsv1.Deployment
+	helm.UnmarshalK8SYaml(s.T(), output, &deployment)
+
+	// then
+	podContainers := deployment.Spec.Template.Spec.InitContainers
+	expectedContainer := corev1.Container{
+		Name:  "nginx",
+		Image: "nginx:latest",
+		Ports: []corev1.ContainerPort{
+			{
+				ContainerPort: 80,
+			},
+		},
+	}
+
+	s.Require().Contains(podContainers, expectedContainer)
+}
diff --git a/charts/camunda-platform/test/unit/web-modeler/deployment_webapp_test.go b/charts/camunda-platform/test/unit/web-modeler/deployment_webapp_test.go
index 8e028ec4..a884afcc 100644
--- a/charts/camunda-platform/test/unit/web-modeler/deployment_webapp_test.go
+++ b/charts/camunda-platform/test/unit/web-modeler/deployment_webapp_test.go
@@ -408,7 +408,7 @@ func (s *webappDeploymentTemplateTest) TestContainerProbesWithContextPath() {
 			"webModeler.webapp.livenessProbe.probePath":  "/live",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -456,3 +456,36 @@ func (s *webappDeploymentTemplateTest) TestContainerSetSidecar() {
 
 	s.Require().Contains(podContainers, expectedContainer)
 }
+
+func (s *webappDeploymentTemplateTest) TestContainerSetInitContainer() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"webModeler.enabled":                                         "true",
+			"webModeler.restapi.mail.fromAddress":                        "example@example.com",
+			"webModeler.webapp.initContainers[0].name":                   "nginx",
+			"webModeler.webapp.initContainers[0].image":                  "nginx:latest",
+			"webModeler.webapp.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var deployment appsv1.Deployment
+	helm.UnmarshalK8SYaml(s.T(), output, &deployment)
+
+	// then
+	podContainers := deployment.Spec.Template.Spec.InitContainers
+	expectedContainer := corev1.Container{
+		Name:  "nginx",
+		Image: "nginx:latest",
+		Ports: []corev1.ContainerPort{
+			{
+				ContainerPort: 80,
+			},
+		},
+	}
+
+	s.Require().Contains(podContainers, expectedContainer)
+}
diff --git a/charts/camunda-platform/test/unit/web-modeler/deployment_websockets_test.go b/charts/camunda-platform/test/unit/web-modeler/deployment_websockets_test.go
index d61f239b..cc7756b3 100644
--- a/charts/camunda-platform/test/unit/web-modeler/deployment_websockets_test.go
+++ b/charts/camunda-platform/test/unit/web-modeler/deployment_websockets_test.go
@@ -174,3 +174,36 @@ func (s *websocketsDeploymentTemplateTest) TestContainerSetSidecar() {
 
 	s.Require().Contains(podContainers, expectedContainer)
 }
+
+func (s *websocketsDeploymentTemplateTest) TestContainerSetInitContainer() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"webModeler.enabled":                                             "true",
+			"webModeler.restapi.mail.fromAddress":                            "example@example.com",
+			"webModeler.websockets.initContainers[0].name":                   "nginx",
+			"webModeler.websockets.initContainers[0].image":                  "nginx:latest",
+			"webModeler.websockets.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var deployment appsv1.Deployment
+	helm.UnmarshalK8SYaml(s.T(), output, &deployment)
+
+	// then
+	podContainers := deployment.Spec.Template.Spec.InitContainers
+	expectedContainer := corev1.Container{
+		Name:  "nginx",
+		Image: "nginx:latest",
+		Ports: []corev1.ContainerPort{
+			{
+				ContainerPort: 80,
+			},
+		},
+	}
+
+	s.Require().Contains(podContainers, expectedContainer)
+}
diff --git a/charts/camunda-platform/test/unit/web-modeler/golden/deployment-restapi.golden.yaml b/charts/camunda-platform/test/unit/web-modeler/golden/deployment-restapi.golden.yaml
index e1e88324..d9aa2ac9 100644
--- a/charts/camunda-platform/test/unit/web-modeler/golden/deployment-restapi.golden.yaml
+++ b/charts/camunda-platform/test/unit/web-modeler/golden/deployment-restapi.golden.yaml
@@ -37,6 +37,8 @@ spec:
     spec:
       imagePullSecrets:
         []
+      initContainers:
+        []
       containers:
       - name: web-modeler-restapi
         image: "registry.camunda.cloud/web-modeler-ee/modeler-restapi:8.2.6"
diff --git a/charts/camunda-platform/test/unit/web-modeler/golden/deployment-webapp.golden.yaml b/charts/camunda-platform/test/unit/web-modeler/golden/deployment-webapp.golden.yaml
index d4259e60..f0661f57 100644
--- a/charts/camunda-platform/test/unit/web-modeler/golden/deployment-webapp.golden.yaml
+++ b/charts/camunda-platform/test/unit/web-modeler/golden/deployment-webapp.golden.yaml
@@ -37,6 +37,8 @@ spec:
     spec:
       imagePullSecrets:
         []
+      initContainers:
+        []
       containers:
       - name: web-modeler-webapp
         image: "registry.camunda.cloud/web-modeler-ee/modeler-webapp:8.2.6"
diff --git a/charts/camunda-platform/test/unit/web-modeler/golden/deployment-websockets.golden.yaml b/charts/camunda-platform/test/unit/web-modeler/golden/deployment-websockets.golden.yaml
index d26fe38d..03b915c1 100644
--- a/charts/camunda-platform/test/unit/web-modeler/golden/deployment-websockets.golden.yaml
+++ b/charts/camunda-platform/test/unit/web-modeler/golden/deployment-websockets.golden.yaml
@@ -37,6 +37,8 @@ spec:
     spec:
       imagePullSecrets:
         []
+      initContainers:
+        []
       containers:
       - name: web-modeler-websockets
         image: "registry.camunda.cloud/web-modeler-ee/modeler-websockets:8.2.6"
diff --git a/charts/camunda-platform/test/unit/zeebe-gateway/deployment_test.go b/charts/camunda-platform/test/unit/zeebe-gateway/deployment_test.go
index 43f04c5a..996bc676 100644
--- a/charts/camunda-platform/test/unit/zeebe-gateway/deployment_test.go
+++ b/charts/camunda-platform/test/unit/zeebe-gateway/deployment_test.go
@@ -601,6 +601,37 @@ func (s *deploymentTemplateTest) TestContainerSetExtraInitContainers() {
 	s.Require().Equal([]string{"sh", "-c", "top"}, initContainer.Command)
 }
 
+func (s *deploymentTemplateTest) TestInitContainers() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"zeebe-gateway.initContainers[0].name":                   "nginx",
+			"zeebe-gateway.initContainers[0].image":                  "nginx:latest",
+			"zeebe-gateway.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var deployment appsv1.Deployment
+	helm.UnmarshalK8SYaml(s.T(), output, &deployment)
+
+	// then
+	podContainers := deployment.Spec.Template.Spec.InitContainers
+	expectedContainer := corev1.Container{
+		Name:  "nginx",
+		Image: "nginx:latest",
+		Ports: []corev1.ContainerPort{
+			{
+				ContainerPort: 80,
+			},
+		},
+	}
+
+	s.Require().Contains(podContainers, expectedContainer)
+}
+
 func (s *deploymentTemplateTest) TestContainerShouldOverwriteGlobalImagePullPolicy() {
 	// given
 	options := &helm.Options{
@@ -638,7 +669,7 @@ func (s *deploymentTemplateTest) TestContainerStartupProbe() {
 			"zeebe-gateway.startupProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -670,7 +701,7 @@ func (s *deploymentTemplateTest) TestContainerLivenessProbe() {
 			"zeebe-gateway.livenessProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -702,7 +733,7 @@ func (s *deploymentTemplateTest) TestContainerProbesWithContextPath() {
 			"zeebe-gateway.livenessProbe.probePath":  "/live",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
diff --git a/charts/camunda-platform/test/unit/zeebe-gateway/golden/gateway-deployment.golden.yaml b/charts/camunda-platform/test/unit/zeebe-gateway/golden/gateway-deployment.golden.yaml
index 4a8a66af..f8ff147a 100644
--- a/charts/camunda-platform/test/unit/zeebe-gateway/golden/gateway-deployment.golden.yaml
+++ b/charts/camunda-platform/test/unit/zeebe-gateway/golden/gateway-deployment.golden.yaml
@@ -39,6 +39,8 @@ spec:
     spec:
       imagePullSecrets:
         []
+      initContainers:
+        []
       containers:
         - name: zeebe-gateway
           image: "camunda/zeebe:8.2.13"
diff --git a/charts/camunda-platform/test/unit/zeebe/golden/statefulset.golden.yaml b/charts/camunda-platform/test/unit/zeebe/golden/statefulset.golden.yaml
index 3d06b2ac..c489e35a 100644
--- a/charts/camunda-platform/test/unit/zeebe/golden/statefulset.golden.yaml
+++ b/charts/camunda-platform/test/unit/zeebe/golden/statefulset.golden.yaml
@@ -42,6 +42,7 @@ spec:
       imagePullSecrets:
         []
       initContainers:
+        []
       containers:
       - name: zeebe
         image: "camunda/zeebe:8.2.13"
diff --git a/charts/camunda-platform/test/unit/zeebe/statefulset_test.go b/charts/camunda-platform/test/unit/zeebe/statefulset_test.go
index 3e784cb8..1761542a 100644
--- a/charts/camunda-platform/test/unit/zeebe/statefulset_test.go
+++ b/charts/camunda-platform/test/unit/zeebe/statefulset_test.go
@@ -211,6 +211,29 @@ func (s *statefulSetTest) TestContainerSetExtraInitContainers() {
 	s.Require().Equal("/exporters/", initContainer.VolumeMounts[0].MountPath)
 }
 
+func (s *statefulSetTest) TestInitContainers() {
+	// given
+	options := &helm.Options{
+		SetValues: map[string]string{
+			"zeebe.initContainers[0].name":                   "nginx",
+			"zeebe.initContainers[0].image":                  "nginx:latest",
+			"zeebe.initContainers[0].ports[0].containerPort": "80",
+		},
+		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
+	}
+
+	// when
+	output := helm.RenderTemplate(s.T(), options, s.chartPath, s.release, s.templates)
+	var statefulSet appsv1.StatefulSet
+	helm.UnmarshalK8SYaml(s.T(), output, &statefulSet)
+
+	// then
+	initContainer := statefulSet.Spec.Template.Spec.InitContainers[0]
+	s.Require().Equal("nginx", initContainer.Name)
+	s.Require().Equal("nginx:latest", initContainer.Image)
+
+}
+
 func (s *statefulSetTest) TestContainerOverwriteImageTag() {
 	// given
 	options := &helm.Options{
@@ -385,7 +408,7 @@ func (s *statefulSetTest) TestContainerSetExtraVolumes() {
 			"zeebe.extraVolumes[0].configMap.defaultMode": "744",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -412,7 +435,7 @@ func (s *statefulSetTest) TestContainerSetExtraVolumeMounts() {
 			"zeebe.extraVolumeMounts[0].mountPath": "/usr/local/config",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -649,7 +672,7 @@ func (s *statefulSetTest) TestContainerSetPersistenceTypeRam() {
 			"zeebe.persistenceType": "memory",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -681,7 +704,7 @@ func (s *statefulSetTest) TestContainerSetPersistenceTypeLocal() {
 			"zeebe.persistenceType": "local",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -742,7 +765,7 @@ func (s *statefulSetTest) TestContainerStartupProbe() {
 			"zeebe.startupProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -774,7 +797,7 @@ func (s *statefulSetTest) TestContainerLivenessProbe() {
 			"zeebe.livenessProbe.timeoutSeconds":      "1",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when
@@ -806,7 +829,7 @@ func (s *statefulSetTest) TestContainerProbesWithContextPath() {
 			"zeebe.livenessProbe.probePath":  "/live",
 		},
 		KubectlOptions: k8s.NewKubectlOptions("", "", s.namespace),
-		ExtraArgs:      map[string][]string{"template": {"--debug"}, "install": {"--debug"}},
+		ExtraArgs:      map[string][]string{"install": {"--debug"}},
 	}
 
 	// when