diff --git a/.circleci/config.yml b/.circleci/config.yml
index 7582bdc21..ca48a33d4 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -3,68 +3,19 @@ orbs:
   slack: circleci/slack@3.4.2
 
 jobs:
-  bats-unit-test:
-    docker:
-      # This image is built from test/docker/Test.dockerfile
-      - image: docker.mirror.hashicorp.services/hashicorpdev/vault-helm-test:0.2.0
-    steps:
-      - checkout
-      - run: bats ./test/unit -t
-
-  chart-verifier:
-    docker:
-      - image: docker.mirror.hashicorp.services/cimg/go:1.16
-    environment:
-      BATS_VERSION: "1.3.0"
-      CHART_VERIFIER_VERSION: "1.2.1"
-    steps:
-      - checkout
-      - run:
-          name: install chart-verifier
-          command: go get github.com/redhat-certification/chart-verifier@${CHART_VERIFIER_VERSION}
-      - run:
-          name: install bats
-          command: |
-            curl -sSL https://github.com/bats-core/bats-core/archive/v${BATS_VERSION}.tar.gz -o /tmp/bats.tgz
-            tar -zxf /tmp/bats.tgz -C /tmp
-            sudo /bin/bash /tmp/bats-core-${BATS_VERSION}/install.sh /usr/local
-      - run:
-          name: run chart-verifier tests
-          command: bats ./test/chart -t
-
-  acceptance:
-    docker:
-      # This image is build from test/docker/Test.dockerfile
-      - image: docker.mirror.hashicorp.services/hashicorpdev/vault-helm-test:0.2.0
-
-    steps:
-      - checkout
-      - run:
-          name: terraform init & apply
-          command: |
-            echo -e "${GOOGLE_APP_CREDS}" | base64 -d > vault-helm-test.json
-            export GOOGLE_CREDENTIALS=vault-helm-test.json
-            make provision-cluster
-      - run:
-          name: Run acceptance tests
-          command: bats ./test/acceptance -t
-
-      - run:
-          name: terraform destroy
-          command: |
-            export GOOGLE_CREDENTIALS=vault-helm-test.json
-            make destroy-cluster
-          when: always
   update-helm-charts-index:
     docker:
-      - image: docker.mirror.hashicorp.services/circleci/golang:1.15.3
+      - image: docker.mirror.hashicorp.services/cimg/go:1.19.2
     steps:
       - checkout
       - run:
           name: verify Chart version matches tag version
+          environment:
+            RELEASE_TAG: << pipeline.parameters.release-tag >>
           command: |
-            GO111MODULE=on go get github.com/mikefarah/yq/v2
-            git_tag=$(echo "${CIRCLE_TAG#v}")
+            go install github.com/mikefarah/yq/v2@latest
+            export TAG=${RELEASE_TAG:-$CIRCLE_TAG}
+            git_tag=$(echo "${TAG#v}")
             chart_tag=$(yq r Chart.yaml version)
             if [ "${git_tag}" != "${chart_tag}" ]; then
               echo "chart version (${chart_tag}) did not match git version (${git_tag})"
@@ -72,17 +23,25 @@ jobs:
             fi
       - run:
           name: update helm-charts index
+          environment:
+            RELEASE_TAG: << pipeline.parameters.release-tag >>
           command: |
             curl --show-error --silent --fail --user "${CIRCLE_TOKEN}:" \
                 -X POST \
                 -H 'Content-Type: application/json' \
                 -H 'Accept: application/json' \
-                -d "{\"branch\": \"main\",\"parameters\":{\"SOURCE_REPO\": \"${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}\",\"SOURCE_TAG\": \"${CIRCLE_TAG}\"}}" \
+                -d "{\"branch\": \"main\",\"parameters\":{\"SOURCE_REPO\": \"${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}\",\"SOURCE_TAG\": \"${RELEASE_TAG:-$CIRCLE_TAG}\"}}" \
                 "${CIRCLE_ENDPOINT}/${CIRCLE_PROJECT}/pipeline"
       - slack/status:
           fail_only: true
           failure_message: "Failed to trigger an update to the helm charts index. Check the logs at: ${CIRCLE_BUILD_URL}"
 
+parameters:
+  release-tag:
+    type: string
+    default: ""
+    description: "The tag to release, including v, e.g. v0.22.1"
+
 workflows:
   version: 2
   # Note: unit and acceptance tests are now being run in GitHub Actions
@@ -95,3 +54,8 @@ workflows:
               only: /^v.*/
             branches:
               ignore: /.*/
+  manual-trigger-update-helm-charts-index:
+    when: << pipeline.parameters.release-tag >>
+    jobs:
+      - update-helm-charts-index:
+          context: helm-charts-trigger-vault
diff --git a/.github/workflows/acceptance.yaml b/.github/workflows/acceptance.yaml
index 042bfd1d5..648616b35 100644
--- a/.github/workflows/acceptance.yaml
+++ b/.github/workflows/acceptance.yaml
@@ -7,19 +7,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kind-k8s-version: [1.16.15, 1.20.15, 1.21.14, 1.22.13, 1.23.10, 1.24.4, 1.25.0]
+        kind-k8s-version: [1.16.15, 1.20.15, 1.21.14, 1.22.15, 1.23.12, 1.24.6, 1.25.3]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Setup test tools
         uses: ./.github/workflows/setup-test-tools
 
       - name: Create K8s Kind Cluster
-        uses: helm/kind-action@v1.2.0
+        uses: helm/kind-action@v1.4.0
         with:
           config: test/kind/config.yaml
           node_image: kindest/node:v${{ matrix.kind-k8s-version }}
-          version: v0.14.0
+          version: v0.16.0
 
       - run: bats --tap --timing ./test/acceptance
         env:
diff --git a/.github/workflows/setup-test-tools/action.yaml b/.github/workflows/setup-test-tools/action.yaml
index 3fa285416..8c69e3db8 100644
--- a/.github/workflows/setup-test-tools/action.yaml
+++ b/.github/workflows/setup-test-tools/action.yaml
@@ -6,13 +6,15 @@ runs:
   steps:
     - uses: actions/setup-node@v2
       with:
-        node-version: '14'
+        node-version: '16'
     - run: npm install -g bats@${BATS_VERSION}
       shell: bash
       env:
-        BATS_VERSION: '1.5.0'
+        BATS_VERSION: '1.8.2'
     - run: bats -v
       shell: bash
-    - uses: actions/setup-python@v2
+    - uses: actions/setup-python@v4
+      with:
+        python-version: '3.10'
     - run: pip install yq
       shell: bash
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 53a1f039e..bcabd1d64 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -6,7 +6,7 @@ jobs:
   bats-unit-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: ./.github/workflows/setup-test-tools
       - run: bats --tap --timing ./test/unit
 
@@ -15,11 +15,11 @@ jobs:
     env:
       CHART_VERIFIER_VERSION: '1.2.1'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Setup test tools
         uses: ./.github/workflows/setup-test-tools
-      - uses: actions/setup-go@v2
+      - uses: actions/setup-go@v3
         with:
-          go-version: '1.17.4'
+          go-version: '1.19.2'
       - run: go install github.com/redhat-certification/chart-verifier@${CHART_VERIFIER_VERSION}
       - run: bats --tap --timing ./test/chart
diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa0e4b734..631553f81 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,26 @@
 ## Unreleased
 
+## 0.23.0 (November 28th, 2022)
+
+Changes:
+* `vault` updated to 1.12.1 [GH-814](https://github.com/hashicorp/vault-helm/pull/814)
+* `vault-k8s` updated to 1.1.0 [GH-814](https://github.com/hashicorp/vault-helm/pull/814)
+* `vault-csi-provider` updated to 1.2.1 [GH-814](https://github.com/hashicorp/vault-helm/pull/814)
+
+Features:
+* server: Add `extraLabels` for Vault server serviceAccount [GH-806](https://github.com/hashicorp/vault-helm/pull/806)
+* server: Add `server.service.active.enabled` and `server.service.standby.enabled` options to selectively disable additional services [GH-811](https://github.com/hashicorp/vault-helm/pull/811)
+* server: Add `server.serviceAccount.serviceDiscovery.enabled` option to selectively disable a Vault service discovery role and role binding [GH-811](https://github.com/hashicorp/vault-helm/pull/811)
+* server: Add `server.service.instanceSelector.enabled` option to allow selecting pods outside the helm chart deployment [GH-813](https://github.com/hashicorp/vault-helm/pull/813)
+
+Bugs:
+* server: Quote `.server.ha.clusterAddr` value [GH-810](https://github.com/hashicorp/vault-helm/pull/810)
+
+## 0.22.1 (October 26th, 2022)
+
+Changes:
+* `vault` updated to 1.12.0 [GH-803](https://github.com/hashicorp/vault-helm/pull/803)
+* `vault-k8s` updated to 1.0.1 [GH-803](https://github.com/hashicorp/vault-helm/pull/803)
 
 ## 0.22.0 (September 8th, 2022)
 
diff --git a/Chart.yaml b/Chart.yaml
index 4289e6c7d..f42a831e4 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: vault
-version: 0.22.0
-appVersion: 1.11.3
+version: 0.23.0
+appVersion: 1.12.1
 kubeVersion: ">= 1.16.0-0"
 description: Official HashiCorp Vault Chart
 home: https://www.vaultproject.io
diff --git a/LICENSE.md b/LICENSE
similarity index 99%
rename from LICENSE.md
rename to LICENSE
index 82b4de97c..74f38c010 100644
--- a/LICENSE.md
+++ b/LICENSE
@@ -1,3 +1,5 @@
+Copyright (c) 2018 HashiCorp, Inc.
+
 Mozilla Public License, version 2.0
 
 1. Definitions
diff --git a/Makefile b/Makefile
index afa801370..e423f3529 100644
--- a/Makefile
+++ b/Makefile
@@ -4,7 +4,6 @@ CLOUDSDK_CORE_PROJECT?=vault-helm-dev-246514
 # set to run a single test - e.g acceptance/server-ha-enterprise-dr.bats
 ACCEPTANCE_TESTS?=acceptance
 
-
 # filter bats unit tests to run.
 UNIT_TESTS_FILTER?='.*'
 
diff --git a/templates/server-discovery-role.yaml b/templates/server-discovery-role.yaml
index 9ca23dd4c..4dba09df1 100644
--- a/templates/server-discovery-role.yaml
+++ b/templates/server-discovery-role.yaml
@@ -1,7 +1,7 @@
 {{ template "vault.mode" . }}
-{{- if ne .mode "external" }}
 {{- if .serverEnabled -}}
 {{- if eq .mode "ha" }}
+{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
diff --git a/templates/server-discovery-rolebinding.yaml b/templates/server-discovery-rolebinding.yaml
index 6e22e4c2b..280ec6ca2 100644
--- a/templates/server-discovery-rolebinding.yaml
+++ b/templates/server-discovery-rolebinding.yaml
@@ -1,7 +1,7 @@
 {{ template "vault.mode" . }}
-{{- if ne .mode "external" }}
 {{- if .serverEnabled -}}
 {{- if eq .mode "ha" }}
+{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
 {{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- else }}
diff --git a/templates/server-ha-active-service.yaml b/templates/server-ha-active-service.yaml
index ef212376d..7def2a0e8 100644
--- a/templates/server-ha-active-service.yaml
+++ b/templates/server-ha-active-service.yaml
@@ -3,6 +3,7 @@
 {{- template "vault.serverServiceEnabled" . -}}
 {{- if .serverServiceEnabled -}}
 {{- if eq .mode "ha" }}
+{{- if eq (.Values.server.service.active.enabled | toString) "true" }}
 # Service for active Vault pod
 apiVersion: v1
 kind: Service
@@ -38,9 +39,12 @@ spec:
       targetPort: 8201
   selector:
     app.kubernetes.io/name: {{ include "vault.name" . }}
+    {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- end }}
     component: server
     vault-active: "true"
 {{- end }}
 {{- end }}
 {{- end }}
+{{- end }}
diff --git a/templates/server-ha-standby-service.yaml b/templates/server-ha-standby-service.yaml
index e6d66af84..50fca4bc1 100644
--- a/templates/server-ha-standby-service.yaml
+++ b/templates/server-ha-standby-service.yaml
@@ -3,6 +3,7 @@
 {{- template "vault.serverServiceEnabled" . -}}
 {{- if .serverServiceEnabled -}}
 {{- if eq .mode "ha" }}
+{{- if eq (.Values.server.service.standby.enabled | toString) "true" }}
 # Service for standby Vault pod
 apiVersion: v1
 kind: Service
@@ -37,9 +38,12 @@ spec:
       targetPort: 8201
   selector:
     app.kubernetes.io/name: {{ include "vault.name" . }}
+    {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- end }}
     component: server
     vault-active: "false"
 {{- end }}
 {{- end }}
-{{- end }}
\ No newline at end of file
+{{- end }}
+{{- end }}
diff --git a/templates/server-service.yaml b/templates/server-service.yaml
index 68207a2db..e4aee81de 100644
--- a/templates/server-service.yaml
+++ b/templates/server-service.yaml
@@ -41,7 +41,9 @@ spec:
       targetPort: 8201
   selector:
     app.kubernetes.io/name: {{ include "vault.name" . }}
+    {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- end }}
     component: server
 {{- end }}
 {{- end }}
diff --git a/templates/server-serviceaccount.yaml b/templates/server-serviceaccount.yaml
index c0d32d190..580a95375 100644
--- a/templates/server-serviceaccount.yaml
+++ b/templates/server-serviceaccount.yaml
@@ -10,5 +10,8 @@ metadata:
     app.kubernetes.io/name: {{ include "vault.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- if  .Values.server.serviceAccount.extraLabels -}}
+      {{- toYaml .Values.server.serviceAccount.extraLabels | nindent 4 -}}
+    {{- end -}}
   {{ template "vault.serviceAccount.annotations" . }}
 {{ end }}
diff --git a/templates/server-statefulset.yaml b/templates/server-statefulset.yaml
index afc48d695..a4ec05a28 100644
--- a/templates/server-statefulset.yaml
+++ b/templates/server-statefulset.yaml
@@ -49,6 +49,9 @@ spec:
       shareProcessNamespace: true
       {{ end }}
       {{- template "server.statefulSet.securityContext.pod" . }}
+      {{- if not .Values.global.openshift }}
+      hostNetwork: {{ .Values.server.hostNetwork }}
+      {{- end }}
       volumes:
         {{ template "vault.volumes" . }}
         - name: home
@@ -102,7 +105,7 @@ spec:
                   fieldPath: metadata.name
             - name: VAULT_CLUSTER_ADDR
               {{- if .Values.server.ha.clusterAddr }}
-              value: {{ .Values.server.ha.clusterAddr }}
+              value: {{ .Values.server.ha.clusterAddr | quote }}
               {{- else }}
               value: "https://$(HOSTNAME).{{ template "vault.fullname" . }}-internal:8201"
               {{- end }}
diff --git a/test/acceptance/server-ha-enterprise-dr.bats b/test/acceptance/server-ha-enterprise-dr.bats
index f09bbb1fc..11effe99c 100644
--- a/test/acceptance/server-ha-enterprise-dr.bats
+++ b/test/acceptance/server-ha-enterprise-dr.bats
@@ -7,7 +7,7 @@ load _helpers
 
   helm install "$(name_prefix)-east" \
     --set='server.image.repository=hashicorp/vault-enterprise' \
-    --set='server.image.tag=1.11.3-ent' \
+    --set='server.image.tag=1.12.1-ent' \
     --set='injector.enabled=false' \
     --set='server.ha.enabled=true' \
     --set='server.ha.raft.enabled=true' \
@@ -75,7 +75,7 @@ load _helpers
   helm install "$(name_prefix)-west" \
     --set='injector.enabled=false' \
     --set='server.image.repository=hashicorp/vault-enterprise' \
-    --set='server.image.tag=1.11.3-ent' \
+    --set='server.image.tag=1.12.1-ent' \
     --set='server.ha.enabled=true' \
     --set='server.ha.raft.enabled=true' \
     --set='server.enterpriseLicense.secretName=vault-license' .
diff --git a/test/acceptance/server-ha-enterprise-perf.bats b/test/acceptance/server-ha-enterprise-perf.bats
index 8b5c1be30..7eaf0ccf0 100644
--- a/test/acceptance/server-ha-enterprise-perf.bats
+++ b/test/acceptance/server-ha-enterprise-perf.bats
@@ -8,7 +8,7 @@ load _helpers
   helm install "$(name_prefix)-east" \
     --set='injector.enabled=false' \
     --set='server.image.repository=hashicorp/vault-enterprise' \
-    --set='server.image.tag=1.11.3-ent' \
+    --set='server.image.tag=1.12.1-ent' \
     --set='server.ha.enabled=true' \
     --set='server.ha.raft.enabled=true' \
     --set='server.enterpriseLicense.secretName=vault-license' .
@@ -75,7 +75,7 @@ load _helpers
   helm install "$(name_prefix)-west" \
     --set='injector.enabled=false' \
     --set='server.image.repository=hashicorp/vault-enterprise' \
-    --set='server.image.tag=1.11.3-ent' \
+    --set='server.image.tag=1.12.1-ent' \
     --set='server.ha.enabled=true' \
     --set='server.ha.raft.enabled=true' \
     --set='server.enterpriseLicense.secretName=vault-license' .
diff --git a/test/unit/server-discovery-role.bats b/test/unit/server-discovery-role.bats
new file mode 100755
index 000000000..11473a081
--- /dev/null
+++ b/test/unit/server-discovery-role.bats
@@ -0,0 +1,41 @@
+#!/usr/bin/env bats
+
+load _helpers
+
+@test "server/DiscoveryRole: enabled by default with ha" {
+  cd `chart_dir`
+  local actual=$( (helm template \
+      --show-only templates/server-discovery-role.yaml \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "false" ]
+
+  local actual=$( (helm template \
+      --show-only templates/server-discovery-role.yaml \
+      --set 'server.ha.enabled=true' \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
+@test "server/DiscoveryRole: can disable with server.enabled false" {
+  cd `chart_dir`
+  local actual=$( (helm template \
+      --show-only templates/server-discovery-role.yaml \
+      --set 'server.enabled=false' \
+      --set 'server.ha.enabled=true' \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "false" ]
+}
+
+@test "server/DiscoveryRole: can disable with server.serviceAccount.serviceDiscovery.enabled false" {
+  cd `chart_dir`
+  local actual=$( (helm template \
+      --show-only templates/server-discovery-role.yaml \
+      --set 'server.ha.enabled=true' \
+      --set 'server.serviceAccount.serviceDiscovery.enabled=false' \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "false" ]
+}
diff --git a/test/unit/server-discovery-rolebinding.bats b/test/unit/server-discovery-rolebinding.bats
new file mode 100755
index 000000000..568c24072
--- /dev/null
+++ b/test/unit/server-discovery-rolebinding.bats
@@ -0,0 +1,41 @@
+#!/usr/bin/env bats
+
+load _helpers
+
+@test "server/DiscoveryRoleBinding: enabled by default with ha" {
+  cd `chart_dir`
+  local actual=$( (helm template \
+      --show-only templates/server-discovery-rolebinding.yaml \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "false" ]
+
+  local actual=$( (helm template \
+      --show-only templates/server-discovery-rolebinding.yaml \
+      --set 'server.ha.enabled=true' \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
+@test "server/DiscoveryRoleBinding: can disable with server.enabled false" {
+  cd `chart_dir`
+  local actual=$( (helm template \
+      --show-only templates/server-discovery-rolebinding.yaml \
+      --set 'server.enabled=false' \
+      --set 'server.ha.enabled=true' \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "false" ]
+}
+
+@test "server/DiscoveryRoleBinding: can disable with server.serviceAccount.serviceDiscovery.enabled false" {
+  cd `chart_dir`
+  local actual=$( (helm template \
+      --show-only templates/server-discovery-rolebinding.yaml \
+      --set 'server.ha.enabled=true' \
+      --set 'server.serviceAccount.serviceDiscovery.enabled=false' \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "false" ]
+}
diff --git a/test/unit/server-ha-active-service.bats b/test/unit/server-ha-active-service.bats
index d74e74913..d78f5d457 100755
--- a/test/unit/server-ha-active-service.bats
+++ b/test/unit/server-ha-active-service.bats
@@ -35,6 +35,18 @@ load _helpers
   [ "${actual}" = "false" ]
 }
 
+@test "server/ha-active-Service: disable with server.service.active.enabled false" {
+  cd `chart_dir`
+  local actual=$( (helm template \
+      --show-only templates/server-ha-active-service.yaml  \
+      --set 'server.ha.enabled=true' \
+      --set 'server.service.enabled=true' \
+      --set 'server.service.active.enabled=false' \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "false" ]
+}
+
 @test "server/ha-active-Service: type empty by default" {
   cd `chart_dir`
   local actual=$(helm template \
@@ -214,3 +226,21 @@ load _helpers
       yq -r '.spec.publishNotReadyAddresses' | tee /dev/stderr)
   [ "${actual}" = "false" ]
 }
+
+@test "server/ha-active-Service: instance selector can be disabled" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/server-ha-active-service.yaml \
+      --set 'server.ha.enabled=true' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "release-name" ]
+
+  local actual=$(helm template \
+      --show-only templates/server-ha-active-service.yaml \
+      --set 'server.ha.enabled=true' \
+      --set 'server.service.instanceSelector.enabled=false' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "null" ]
+}
diff --git a/test/unit/server-ha-standby-service.bats b/test/unit/server-ha-standby-service.bats
index 045560ce9..669831411 100755
--- a/test/unit/server-ha-standby-service.bats
+++ b/test/unit/server-ha-standby-service.bats
@@ -46,6 +46,18 @@ load _helpers
   [ "${actual}" = "false" ]
 }
 
+@test "server/ha-standby-Service: disable with server.service.standby.enabled false" {
+  cd `chart_dir`
+  local actual=$( (helm template \
+      --show-only templates/server-ha-standby-service.yaml  \
+      --set 'server.ha.enabled=true' \
+      --set 'server.service.enabled=true' \
+      --set 'server.service.standby.enabled=false' \
+      . || echo "---") | tee /dev/stderr |
+      yq 'length > 0' | tee /dev/stderr)
+  [ "${actual}" = "false" ]
+}
+
 @test "server/ha-standby-Service: type empty by default" {
   cd `chart_dir`
   local actual=$(helm template \
@@ -225,3 +237,21 @@ load _helpers
       yq -r '.spec.publishNotReadyAddresses' | tee /dev/stderr)
   [ "${actual}" = "false" ]
 }
+
+@test "server/ha-standby-Service: instance selector can be disabled" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/server-ha-standby-service.yaml \
+      --set 'server.ha.enabled=true' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "release-name" ]
+
+  local actual=$(helm template \
+      --show-only templates/server-ha-standby-service.yaml \
+      --set 'server.ha.enabled=true' \
+      --set 'server.service.instanceSelector.enabled=false' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "null" ]
+}
diff --git a/test/unit/server-ha-statefulset.bats b/test/unit/server-ha-statefulset.bats
index 342fa433d..06a0ca0a0 100755
--- a/test/unit/server-ha-statefulset.bats
+++ b/test/unit/server-ha-statefulset.bats
@@ -476,6 +476,22 @@ load _helpers
   [ "${value}" = 'http://$(HOSTNAME).release-name-vault-internal:8201' ]
 }
 
+@test "server/ha-StatefulSet: clusterAddr gets quoted" {
+  cd `chart_dir`
+  local customUrl='http://$(HOSTNAME).release-name-vault-internal:8201'
+  local rendered=$(helm template \
+      --show-only templates/server-statefulset.yaml  \
+      --set 'server.ha.enabled=true' \
+      --set 'server.ha.raft.enabled=true' \
+      --set "server.ha.clusterAddr=${customUrl}" \
+      . | tee /dev/stderr | \
+      grep -F "${customUrl}" | tee /dev/stderr)
+
+local value=$(echo $rendered |
+      yq -Y '.' | tee /dev/stderr)
+  [ "${value}" = 'value: "http://$(HOSTNAME).release-name-vault-internal:8201"' ]
+}
+
 #--------------------------------------------------------------------
 # VAULT_RAFT_NODE_ID renders
 
diff --git a/test/unit/server-headless-service.bats b/test/unit/server-headless-service.bats
index 4e2d13537..0794d0e49 100644
--- a/test/unit/server-headless-service.bats
+++ b/test/unit/server-headless-service.bats
@@ -17,3 +17,21 @@ load _helpers
       yq -r '.spec.publishNotReadyAddresses' | tee /dev/stderr)
   [ "${actual}" = "false" ]
 }
+
+@test "server/headless-Service: instance selector cannot be disabled" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/server-headless-service.yaml \
+      --set 'server.ha.enabled=true' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "release-name" ]
+
+  local actual=$(helm template \
+      --show-only templates/server-headless-service.yaml \
+      --set 'server.ha.enabled=true' \
+      --set 'server.service.instanceSelector.enabled=false' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "release-name" ]
+}
diff --git a/test/unit/server-service.bats b/test/unit/server-service.bats
index 5208f6e30..70a544598 100755
--- a/test/unit/server-service.bats
+++ b/test/unit/server-service.bats
@@ -431,3 +431,20 @@ load _helpers
   [ "${actual}" = "null" ]
 }
 
+@test "server/Service: instance selector can be disabled" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/server-service.yaml \
+      --set 'server.ha.enabled=true' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "release-name" ]
+
+  local actual=$(helm template \
+      --show-only templates/server-service.yaml \
+      --set 'server.ha.enabled=true' \
+      --set 'server.service.instanceSelector.enabled=false' \
+      . | tee /dev/stderr |
+      yq -r '.spec.selector["app.kubernetes.io/instance"]' | tee /dev/stderr)
+  [ "${actual}" = "null" ]
+}
diff --git a/test/unit/server-serviceaccount.bats b/test/unit/server-serviceaccount.bats
index fbc2b94bf..2c826032e 100755
--- a/test/unit/server-serviceaccount.bats
+++ b/test/unit/server-serviceaccount.bats
@@ -117,3 +117,13 @@ load _helpers
       yq 'length > 0' | tee /dev/stderr)
   [ "${actual}" = "false" ]
 }
+
+@test "server/serviceAccount: specify server.serviceAccount.extraLabels" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/server-serviceaccount.yaml \
+      --set 'server.serviceAccount.extraLabels.foo=bar' \
+      . | tee /dev/stderr |
+      yq -r '.metadata.labels.foo' | tee /dev/stderr)
+  [ "${actual}" = "bar" ]
+}
\ No newline at end of file
diff --git a/test/unit/server-statefulset.bats b/test/unit/server-statefulset.bats
index 549fcb751..6206e115e 100755
--- a/test/unit/server-statefulset.bats
+++ b/test/unit/server-statefulset.bats
@@ -1784,3 +1784,25 @@ load _helpers
       yq -r '.spec.template.spec.containers[0].securityContext.foo' | tee /dev/stderr)
   [ "${actual}" = "bar" ]
 }
+
+#--------------------------------------------------------------------
+# hostNetwork
+
+@test "server/StatefulSet: server.hostNetwork not set" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/server-statefulset.yaml \
+      . | tee /dev/stderr |
+      yq -r '.spec.template.spec.hostNetwork' | tee /dev/stderr)
+  [ "${actual}" = "false" ]
+}
+
+@test "server/StatefulSet: server.hostNetwork is set" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      --show-only templates/server-statefulset.yaml \
+      --set 'server.hostNetwork=true' \
+      . | tee /dev/stderr |
+      yq -r '.spec.template.spec.hostNetwork' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
diff --git a/test/unit/ui-service.bats b/test/unit/ui-service.bats
index f73bbce3f..384098f89 100755
--- a/test/unit/ui-service.bats
+++ b/test/unit/ui-service.bats
@@ -385,4 +385,3 @@ load _helpers
   [ "${actual}" = "null" ]
 
 }
-
diff --git a/values.openshift.yaml b/values.openshift.yaml
index c932a6897..02985ed39 100644
--- a/values.openshift.yaml
+++ b/values.openshift.yaml
@@ -6,13 +6,13 @@ global:
 injector:
   image:
     repository: "registry.connect.redhat.com/hashicorp/vault-k8s"
-    tag: "1.0.0-ubi"
+    tag: "1.1.0-ubi"
 
   agentImage:
     repository: "registry.connect.redhat.com/hashicorp/vault"
-    tag: "1.11.3-ubi"
+    tag: "1.12.1-ubi"
 
 server:
   image:
     repository: "registry.connect.redhat.com/hashicorp/vault"
-    tag: "1.11.3-ubi"
+    tag: "1.12.1-ubi"
diff --git a/values.schema.json b/values.schema.json
index 8ffc62f0f..d953b82f8 100644
--- a/values.schema.json
+++ b/values.schema.json
@@ -370,9 +370,6 @@
                 "podDisruptionBudget": {
                     "type": "object"
                 },
-                "podDisruptionBudget": {
-                    "type": "object"
-                },
                 "port": {
                     "type": "integer"
                 },
@@ -860,6 +857,14 @@
                 "service": {
                     "type": "object",
                     "properties": {
+                        "active": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
                         "annotations": {
                             "type": [
                                 "object",
@@ -875,12 +880,28 @@
                         "externalTrafficPolicy": {
                             "type": "string"
                         },
+                        "instanceSelector": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
                         "port": {
                             "type": "integer"
                         },
                         "publishNotReadyAddresses": {
                             "type": "boolean"
                         },
+                        "standby": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
                         "targetPort": {
                             "type": "integer"
                         },
@@ -907,8 +928,19 @@
                         "create": {
                             "type": "boolean"
                         },
+                        "extraLabels": {
+                            "type": "object"
+                        },
                         "name": {
                             "type": "string"
+                        },
+                        "serviceDiscovery": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
                         }
                     }
                 },
@@ -991,6 +1023,9 @@
                         "null",
                         "array"
                     ]
+                },
+                "hostNetwork": {
+                    "type": "boolean"
                 }
             }
         },
diff --git a/values.yaml b/values.yaml
index 837cfff00..f6769794c 100644
--- a/values.yaml
+++ b/values.yaml
@@ -62,7 +62,7 @@ injector:
   # image sets the repo and tag of the vault-k8s image to use for the injector.
   image:
     repository: "hashicorp/vault-k8s"
-    tag: "1.0.0"
+    tag: "1.1.0"
     pullPolicy: IfNotPresent
 
   # agentImage sets the repo and tag of the Vault image to use for the Vault Agent
@@ -70,7 +70,7 @@ injector:
   # required.
   agentImage:
     repository: "hashicorp/vault"
-    tag: "1.11.3"
+    tag: "1.12.1"
 
   # The default values for the injected Vault Agent containers.
   agentDefaults:
@@ -125,7 +125,6 @@ injector:
     # for more details.
     #
     timeoutSeconds: 30
-
     # namespaceSelector is the selector for restricting the webhook to only
     # specific namespaces.
     # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
@@ -331,7 +330,7 @@ server:
 
   image:
     repository: "hashicorp/vault"
-    tag: "1.11.3"
+    tag: "1.12.1"
     # Overrides the default Image Pull Policy
     pullPolicy: IfNotPresent
 
@@ -594,6 +593,19 @@ server:
   # Enables a headless service to be used by the Vault Statefulset
   service:
     enabled: true
+    # Enable or disable the vault-active service, which selects Vault pods that
+    # have labelled themselves as the cluster leader with `vault-active: "true"`
+    active:
+      enabled: true
+    # Enable or disable the vault-standby service, which selects Vault pods that
+    # have labelled themselves as a cluster follower with `vault-active: "false"`
+    standby:
+      enabled: true
+    # If enabled, the service selectors will include `app.kubernetes.io/instance: {{ .Release.Name }}`
+    # When disabled, services may select Vault pods not deployed from the chart.
+    # Does not affect the headless vault-internal service with `ClusterIP: None`
+    instanceSelector:
+      enabled: true
     # clusterIP controls whether a Cluster IP address is attached to the
     # Vault service within Kubernetes.  By default, the Vault service will
     # be given a Cluster IP address, set to None to disable.  When disabled
@@ -849,6 +861,14 @@ server:
     # YAML or a YAML-formatted multi-line templated string map of the
     # annotations to apply to the serviceAccount.
     annotations: {}
+    # Extra labels to attach to the serviceAccount
+    # This should be a YAML map of the labels to apply to the serviceAccount
+    extraLabels: {}
+    # Enable or disable a service account role binding with the permissions required for
+    # Vault's Kubernetes service_registration config option.
+    # See https://developer.hashicorp.com/vault/docs/configuration/service-registration/kubernetes
+    serviceDiscovery:
+      enabled: true
   # A boolean flag to setup logrotate as a side car continer
   logrotate: null
 
@@ -876,6 +896,9 @@ server:
       pod: {}
       container: {}
 
+  # Should the server pods run on the host network
+  hostNetwork: false
+
 # Vault UI
 ui:
   # True if you want to create a Service entry for the Vault UI.
@@ -923,7 +946,7 @@ csi:
 
   image:
     repository: "hashicorp/vault-csi-provider"
-    tag: "1.2.0"
+    tag: "1.2.1"
     pullPolicy: IfNotPresent
 
   # volumes is a list of volumes made available to all containers. These are rendered