diff --git a/distributed/control-plane/Chart.yaml b/distributed/control-plane/Chart.yaml
index 9fb58dac..7bb8a1d0 100644
--- a/distributed/control-plane/Chart.yaml
+++ b/distributed/control-plane/Chart.yaml
@@ -13,5 +13,5 @@ apiVersion: v1
 appVersion: "4.5.0"
 description: A Helm chart for the deployment of WSO2 API Management API Control Plane profile
 name: wso2am-acp
-version: 4.5.0-8
+version: 4.5.0-9
 icon: https://wso2.cachefly.net/wso2/sites/all/images/wso2logo.svg
diff --git a/distributed/control-plane/confs/instance-1/deployment.toml b/distributed/control-plane/confs/instance-1/deployment.toml
index 9eeb571c..a78e597f 100644
--- a/distributed/control-plane/confs/instance-1/deployment.toml
+++ b/distributed/control-plane/confs/instance-1/deployment.toml
@@ -113,7 +113,7 @@ password = "$secret{truststore_password}"
 password = {{ .Values.wso2.apim.configurations.security.truststore.password | quote }}
 {{- end }}
 
-{{- range $i, $env := .Values.wso2.apim.configurations.gateway.environments }}
+{{ range $i, $env := .Values.wso2.apim.configurations.gateway.environments }}
 [[apim.gateway.environment]]
 name = {{ $env.name | quote }}
 type = {{ $env.type | quote }}
@@ -135,7 +135,17 @@ https_endpoint = "https://{{ $env.httpHostname }}"
 websub_event_receiver_http_endpoint = "http://{{ $env.websubHostname }}"
 websub_event_receiver_https_endpoint = "https://{{ $env.websubHostname }}"
 
-{{- end }}
+{{ range $j, $vhostenv := $env.virtualHosts }}
+[[apim.gateway.environment.virtual_host]]
+ws_endpoint = "ws://{{ $vhostenv.wsHostname }}"
+wss_endpoint = "wss://{{ $vhostenv.wsHostname }}"
+http_endpoint = "http://{{ $vhostenv.httpHostname }}"
+https_endpoint = "https://{{ $vhostenv.httpHostname }}"
+websub_event_receiver_http_endpoint = "http://{{ $vhostenv.websubHostname }}"
+websub_event_receiver_https_endpoint = "https://{{ $vhostenv.websubHostname }}"
+{{ end }}
+
+{{ end }}
 
 [apim.key_manager]
 {{- if .Values.wso2.apim.configurations.iskm.enabled }}
@@ -249,11 +259,12 @@ auth_urls = ["ssl://{{ template "apim-helm-cp.fullname" . }}-2-service:{{ add 97
 {{- if .Values.wso2.apim.configurations.iskm.enabled }}
 revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/oauth2/revoke"
 {{- else }}
-revoke_endpoint = "https://{{ template "apim-helm-cp.fullname" . }}-service:{{ add 9443 .Values.wso2.apim.portOffset }}/oauth2/revoke"
+revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceName }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/oauth2/revoke"
 {{- end }}
 enable_token_encryption = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenEncryption }}
 enable_token_hashing = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenHashing }}
 allowed_scopes = {{ toJson .Values.wso2.apim.configurations.oauth_config.allowedScopes }}
+#enable_outbound_auth_header = true
 
 {{- if .Values.wso2.apim.configurations.openTracer.enabled }}
 [apim.open_tracer]
@@ -271,6 +282,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn
 remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }}
 {{- end }}
 
+{{- if .Values.wso2.apim.configurations.jmx.enabled }}
+[monitoring.jmx]
+rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+{{- end }}
+
 [apim.ai]
 {{- if .Values.wso2.apim.configurations.ai.enabled }}
 enable = true
diff --git a/distributed/control-plane/confs/instance-2/deployment.toml b/distributed/control-plane/confs/instance-2/deployment.toml
index da9f7105..a573e761 100644
--- a/distributed/control-plane/confs/instance-2/deployment.toml
+++ b/distributed/control-plane/confs/instance-2/deployment.toml
@@ -113,7 +113,7 @@ password = "$secret{truststore_password}"
 password = {{ .Values.wso2.apim.configurations.security.truststore.password | quote }}
 {{- end }}
 
-{{- range $i, $env := .Values.wso2.apim.configurations.gateway.environments }}
+{{ range $i, $env := .Values.wso2.apim.configurations.gateway.environments }}
 [[apim.gateway.environment]]
 name = {{ $env.name | quote }}
 type = {{ $env.type | quote }}
@@ -135,7 +135,17 @@ https_endpoint = "https://{{ $env.httpHostname }}"
 websub_event_receiver_http_endpoint = "http://{{ $env.websubHostname }}"
 websub_event_receiver_https_endpoint = "https://{{ $env.websubHostname }}"
 
-{{- end }}
+{{ range $j, $vhostenv := $env.virtualHosts }}
+[[apim.gateway.environment.virtual_host]]
+ws_endpoint = "ws://{{ $vhostenv.wsHostname }}"
+wss_endpoint = "wss://{{ $vhostenv.wsHostname }}"
+http_endpoint = "http://{{ $vhostenv.httpHostname }}"
+https_endpoint = "https://{{ $vhostenv.httpHostname }}"
+websub_event_receiver_http_endpoint = "http://{{ $vhostenv.websubHostname }}"
+websub_event_receiver_https_endpoint = "https://{{ $vhostenv.websubHostname }}"
+{{ end }}
+
+{{ end }}
 
 [apim.key_manager]
 {{- if .Values.wso2.apim.configurations.iskm.enabled }}
@@ -249,11 +259,12 @@ auth_urls = ["ssl://{{ template "apim-helm-cp.fullname" . }}-2-service:{{ add 97
 {{- if .Values.wso2.apim.configurations.iskm.enabled }}
 revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/oauth2/revoke"
 {{- else }}
-revoke_endpoint = "https://{{ template "apim-helm-cp.fullname" . }}-service:{{ add 9443 .Values.wso2.apim.portOffset }}/oauth2/revoke"
+revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceName }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/oauth2/revoke"
 {{- end }}
 enable_token_encryption = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenEncryption }}
 enable_token_hashing = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenHashing }}
 allowed_scopes = {{ toJson .Values.wso2.apim.configurations.oauth_config.allowedScopes }}
+#enable_outbound_auth_header = true
 
 {{- if .Values.wso2.apim.configurations.openTracer.enabled }}
 [apim.open_tracer]
@@ -271,6 +282,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn
 remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }}
 {{- end }}
 
+{{- if .Values.wso2.apim.configurations.jmx.enabled }}
+[monitoring.jmx]
+rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+{{- end }}
+
 [apim.ai]
 {{- if .Values.wso2.apim.configurations.ai.enabled }}
 enable = true
diff --git a/distributed/control-plane/confs/log4j2.properties b/distributed/control-plane/confs/log4j2.properties
index 8d44ec39..93a1d447 100644
--- a/distributed/control-plane/confs/log4j2.properties
+++ b/distributed/control-plane/confs/log4j2.properties
@@ -6,6 +6,10 @@ appenders = {{ .Values.wso2.apim.log4j2.appenders }}, CARBON_CONSOLE,HTTP_ACCESS
 appenders = CARBON_CONSOLE,HTTP_ACCESS_CONSOLE,AUDIT_CONSOLE,TRANSACTION_CONSOLE,CORRELATION_CONSOLE,CARBON_LOGFILE,AUDIT_LOGFILE,ATOMIKOS_LOGFILE,CARBON_TRACE_LOGFILE,ERROR_LOGFILE,OPEN_TRACING,SERVICE_APPENDER,TRACE_APPENDER,osgi,CORRELATION,BOTDATA_APPENDER,API_LOGFILE, APIM_GATEWAY_ACCESS_APPENDER, APIM_GOV_AUDIT_LOGFILE
 {{- end }}
 
+{{- if .Values.wso2.apim.log4j2.appendersConfig }}
+{{ .Values.wso2.apim.log4j2.appendersConfig }}
+{{- end }}
+
 # CARBON_CONSOLE is set to be a ConsoleAppender using a PatternLayout.
 appender.CARBON_CONSOLE.type = Console
 appender.CARBON_CONSOLE.name = CARBON_CONSOLE
@@ -269,6 +273,10 @@ loggers = {{ .Values.wso2.apim.log4j2.loggers }}, AUDIT_LOG, trace-messages, org
 loggers = AUDIT_LOG, trace-messages, org-apache-coyote, com-hazelcast, Owasp-CsrfGuard, org-apache-axis2-wsdl-codegen-writer-PrettyPrinter, org-apache-axis2-clustering, org-apache-catalina, org-apache-tomcat, org-wso2-carbon-apacheds, org-apache-directory-server-ldap, org-apache-directory-server-core-event, com-atomikos, org-quartz, org-apache-jackrabbit-webdav, org-apache-juddi, org-apache-commons-digester-Digester, org-apache-jasper-compiler-TldLocationsCache, org-apache-qpid, org-apache-qpid-server-Main, qpid-message, qpid-message-broker-listening, org-apache-tiles, org-apache-commons-httpclient, org-apache-solr, me-prettyprint-cassandra-hector-TimingLogger, org-apache-axis-enterprise, org-apache-directory-shared-ldap, org-apache-directory-server-ldap-handlers, org-apache-directory-shared-ldap-entry-DefaultServerAttribute, org-apache-directory-server-core-DefaultDirectoryService, org-apache-directory-shared-ldap-ldif-LdifReader, org-apache-directory-server-ldap-LdapProtocolHandler, org-apache-directory-server-core, org-apache-directory-server-ldap-LdapSession, DataNucleus, Datastore, Datastore-Schema, JPOX-Datastore, JPOX-Plugin, JPOX-MetaData, JPOX-Query, JPOX-General, JPOX-Enhancer, org-apache-hadoop-hive, hive, ExecMapper, ExecReducer, net-sf-ehcache-config-ConfigurationFactory, axis2Deployment, equinox, tomcat2, StAXDialectDetector, trace, synapse, synapse_transport, axis2, axis2_transport, org-wso2-carbon, hunsicker, thrift-publisher, service_logger, trace_logger, org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator, correlation, GatewayAccessLogger
 {{- end }}
 
+{{- if .Values.wso2.apim.log4j2.loggersConfig }}
+{{ .Values.wso2.apim.log4j2.loggersConfig }}
+{{- end }}
+
 logger.API_LOG.name = API_LOG
 logger.API_LOG.level = INFO
 logger.API_LOG.appenderRef.API_LOGFILE.ref = API_LOGFILE
@@ -565,3 +573,10 @@ logger.org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator.appenderRef
 logger.org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator.additivity = false
 
 category.SERVICE_APPENDER._OpenService_ = TRACE_APPENDER, BOTDATA_APPENDER
+
+logger.auth-framework.name = org.wso2.carbon.identity.application.authentication.framework
+logger.auth-framework.level = DEBUG
+logger.auth-framework.appenderRef.CARBON_LOGFILE.ref = CARBON_LOGFILE
+logger.oidc-authenticator.name = org.wso2.carbon.identity.application.authenticator.oidc
+logger.oidc-authenticator.level = DEBUG
+logger.oidc-authenticator.appenderRef.CARBON_LOGFILE.ref = CARBON_LOGFILE
diff --git a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml
index 5d09d892..294364fc 100644
--- a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml
+++ b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-deployment.yaml
@@ -59,6 +59,8 @@ spec:
       {{- else if .Values.azure.enabled }}
       serviceAccount: {{ .Values.azure.serviceAccountName }}
       {{- end }}
+      {{- else if .Values.wso2.deployment.serviceAccountName }}
+      serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }}
       {{- end }}
       securityContext:
         seccompProfile:
@@ -66,14 +68,23 @@ spec:
           {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }}
           localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }}
           {{- end }}
-      {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }}
       imagePullSecrets:
-      - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth
-      {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }}
+        - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth
+        {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- end }}
       containers:
       - name: wso2am-control-plane
+        {{ if .Values.wso2.deployment.image.tag }}
+        image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }}
+        {{- else }}
         image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }}
-        imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }}
+        {{- end }}
+        imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }}
         env:
         - name: PROFILE_NAME
           value: default
@@ -84,6 +95,12 @@ spec:
               fieldPath: status.podIP
         - name: JVM_MEM_OPTS
           value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}"
+        {{- if .Values.wso2.deployment.envs }}
+        {{- range $name, $value := .Values.wso2.deployment.envs }}
+        - name: {{ $name }}
+          value: {{ $value | quote }}
+        {{- end }}
+        {{- end }}
         {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }}
         - name: WSO2_ADMIN_PASSWORD
           valueFrom:
@@ -167,6 +184,12 @@ spec:
             protocol: "TCP"
           - containerPort: {{ add 5672 .Values.wso2.apim.portOffset }}
             protocol: "TCP"
+          {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+          - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+            protocol: "TCP"
+          - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+            protocol: "TCP"
+          {{- end }}
         volumeMounts:
         - name: wso2am-control-plane-conf
           mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml
diff --git a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-service.yaml b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-service.yaml
index f3547855..4bc7b003 100644
--- a/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-service.yaml
+++ b/distributed/control-plane/templates/control-plane/instance-1/wso2am-cp-service.yaml
@@ -33,3 +33,11 @@ spec:
     - name: servlet-https
       protocol: TCP
       port: {{ add 9443 .Values.wso2.apim.portOffset }}
+    {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+    - name: jmx-registry-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+    - name: jmx-server-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+    {{- end }}
diff --git a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml
index dafbb981..62fcc6cc 100644
--- a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml
+++ b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-deployment.yaml
@@ -60,6 +60,8 @@ spec:
       {{- else if .Values.azure.enabled }}
       serviceAccount: {{ .Values.azure.serviceAccountName }}
       {{- end }}
+      {{- else if .Values.wso2.deployment.serviceAccountName }}
+      serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }}
       {{- end }}
       securityContext:
         seccompProfile:
@@ -67,14 +69,23 @@ spec:
           {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }}
           localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }}
           {{- end }}
-      {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }}
       imagePullSecrets:
-      - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth
-      {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }}
+        - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth
+        {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- end }}
       containers:
       - name: wso2am-control-plane
+        {{ if .Values.wso2.deployment.image.tag }}
+        image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }}
+        {{- else }}
         image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }}
-        imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }}
+        {{- end }}
+        imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }}
         env:
         - name: PROFILE_NAME
           value: default
@@ -85,6 +96,12 @@ spec:
               fieldPath: status.podIP
         - name: JVM_MEM_OPTS
           value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}"
+        {{- if .Values.wso2.deployment.envs }}
+        {{- range $name, $value := .Values.wso2.deployment.envs }}
+        - name: {{ $name }}
+          value: {{ $value | quote }}
+        {{- end }}
+        {{- end }}
         {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }}
         - name: WSO2_ADMIN_PASSWORD
           valueFrom:
@@ -168,6 +185,12 @@ spec:
             protocol: "TCP"
           - containerPort: {{ add 5672 .Values.wso2.apim.portOffset }}
             protocol: "TCP"
+          {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+          - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+            protocol: "TCP"
+          - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+            protocol: "TCP"
+          {{- end }}
         volumeMounts:
         - name: wso2am-control-plane-conf
           mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml
diff --git a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-service.yaml b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-service.yaml
index 8a9e8e3a..7d85a810 100644
--- a/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-service.yaml
+++ b/distributed/control-plane/templates/control-plane/instance-2/wso2am-cp-service.yaml
@@ -34,4 +34,12 @@ spec:
     - name: servlet-https
       protocol: TCP
       port: {{ add 9443 .Values.wso2.apim.portOffset }}
+    {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+    - name: jmx-registry-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+    - name: jmx-server-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+    {{- end }}
 {{- end }}
\ No newline at end of file
diff --git a/distributed/control-plane/templates/control-plane/wso2am-cp-service.yaml b/distributed/control-plane/templates/control-plane/wso2am-cp-service.yaml
index 6a6bb263..544bab14 100644
--- a/distributed/control-plane/templates/control-plane/wso2am-cp-service.yaml
+++ b/distributed/control-plane/templates/control-plane/wso2am-cp-service.yaml
@@ -26,3 +26,11 @@ spec:
     - name: servlet-https
       protocol: TCP
       port: {{ add 9443 .Values.wso2.apim.portOffset }}
+    {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+    - name: jmx-registry-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+    - name: jmx-server-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+    {{- end }}
diff --git a/distributed/control-plane/values.yaml b/distributed/control-plane/values.yaml
index 2b153490..0a688cfd 100644
--- a/distributed/control-plane/values.yaml
+++ b/distributed/control-plane/values.yaml
@@ -211,10 +211,31 @@ wso2:
     secureVaultEnabled: false
     # Logging related configurations
     log4j2:
-        # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE
+        # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE or loggers defined in loggersConfig. This should be a comma separated string. For example, if you want to enable audit log and http access log in the console, you can specify the following:
         loggers: ""
-        # -- Appenders
+        # example
+        # loggers: "AUDIT_LOG_CONSOLE,HTTP_ACCESS_CONSOLE, gateway-debug"
+        # -- Custom loggers that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a logger named "gateway-debug" with DEBUG level, you can specify the following:
+        loggersConfig: ""        
+        # example
+        # loggersConfig: |
+        #   # -- Add custom loggers to log4j2.properties. This will be added under the Loggers section of log4j2.properties
+        #   logger.gateway-debug.name = org.wso2.carbon.apimgt.gateway
+        #   logger.gateway-debug.level = DEBUG
+
+        # -- Appenders that can be enabled. Allowed values are appenders defined in appendersConfig. This should be a comma separated string. For example, if you want to enable a file appender named "GatewayFileAppender", you can specify the following:
+        # appenders: "GatewayFileAppender"
         appenders: ""
+
+        # -- Custom appenders that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a file appender named "GatewayFileAppender" that logs gateway logs to a file, you can specify the following:
+        # appendersConfig: |
+        #   # -- Add custom appenders to log4j2.properties. This will be added under the Appenders section of log4j2.properties
+        #   appender.GatewayFileAppender.type = File
+        #   appender.GatewayFileAppender.name = GatewayFileAppender
+        #   appender.GatewayFileAppender.fileName = /home/wso2carbon/logs/gateway.log
+        #   appender.GatewayFileAppender.layout.type = PatternLayout
+        #   appender.GatewayFileAppender.layout.pattern = [%d] %p %c - %m%n
+        appendersConfig: ""
     # -- Startup arguments for APIM
     startupArgs: ""
     # -- Port Offset for APIM deployment
@@ -237,8 +258,8 @@ wso2:
         # https://apim.docs.wso2.com/en/latest/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-the-primary-user-store/
         type: "database_unique_id"
         # -- User store properties
-        properties:
-          key: value
+        properties: {}
+          #key: value
       # -- Super admin username
       adminUsername: ""
       # -- Super admin password
@@ -351,6 +372,11 @@ wso2:
           wsHostname: "websocket.wso2.com"
           httpHostname: "gw.wso2.com"
           websubHostname: "websub.wso2.com"
+          virtualHosts: []
+          # virtualHosts:
+          # - httpHostname: "other-gw.wso2.com"
+          #   wsHostname: "other-websocket.wso2.com"
+          #   websubHostname: "other-websub.wso2.com"
 
       iskm:
         # -- If Identity Server is used as the Resident KM
@@ -422,6 +448,11 @@ wso2:
         hostname: ""
         # -- Remote tracer port
         port: ""
+      # JMX
+      jmx:
+        enabled: false
+        rmiRegistryPort: 9999
+        rmiServerPort: 11111
 
       keyManager:
         enableLightweightAPIKeyGeneration: true
@@ -460,8 +491,10 @@ wso2:
     # Container image configurations
     image:
       # -- Container registry credentials.
-      # Specify image pull secrets for private registries
       imagePullSecrets:
+        # Specify image pull secrets for private registries
+        secrets: []
+        # Specify private registry credentials (upload credentials to values is not recommended)
         enabled: false
         username: ""
         password: ""
@@ -469,6 +502,8 @@ wso2:
       registry: ""
       # -- Azure ACR repository name consisting the image
       repository: ""
+      # -- Docker image tag: if specified, digest is ignored
+      tag: ""
       # -- Docker image digest
       digest: ""
       # -- Refer to the Kubernetes documentation on updating images (https://kubernetes.io/docs/concepts/containers/images/#updating-images)
@@ -494,6 +529,12 @@ wso2:
           # -- JVM heap memory Xmx
           xmx: "2048m"
 
+    # Custom environment variables for the container
+    envs: {}
+    # envs:
+    #   TZ: "Europe/Paris"
+    #   OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService"
+
     # Kubernetes Probes
     # Indicates whether the container starting
     startupProbe:
@@ -553,4 +594,7 @@ wso2:
           # -- For persisting the H2 based local Carbon database file
           carbonDatabase: 50M
           # -- For persisting the indexed solr data
-          solrIndexedData: 50M
\ No newline at end of file
+          solrIndexedData: 50M
+
+    # -- Use a kubernetes serviceAccount. If empty will use default sa.
+    serviceAccountName: ""
diff --git a/distributed/gateway/Chart.yaml b/distributed/gateway/Chart.yaml
index 6f32f9fe..8e8b55d9 100644
--- a/distributed/gateway/Chart.yaml
+++ b/distributed/gateway/Chart.yaml
@@ -13,5 +13,5 @@ apiVersion: v1
 appVersion: "4.5.0"
 description: A Helm chart for the deployment of WSO2 API Management Universal Gateway profile
 name: wso2am-universal-gw
-version: 4.5.0-8
+version: 4.5.0-9
 icon: https://wso2.cachefly.net/wso2/sites/all/images/wso2logo.svg
diff --git a/distributed/gateway/confs/deployment.toml b/distributed/gateway/confs/deployment.toml
index 7e386960..959559a6 100644
--- a/distributed/gateway/confs/deployment.toml
+++ b/distributed/gateway/confs/deployment.toml
@@ -176,7 +176,7 @@ username = "$ref{super_admin.username}"
 password = "$ref{super_admin.password}"
 service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:{{ .Values.wso2.apim.configurations.eventhub.servicePort }}/services/"
 {{- $len := add (len .Values.wso2.apim.configurations.eventhub.urls) -1 }}
-event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}:{{ add 5672 $.Values.wso2.apim.configurations.throttling.portOffset }}"{{ if ne $index $len }},{{ end }}{{ end}}]
+event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}"{{ if ne $index $len }},{{ end }}{{ end}}]
 {{- end }}
 
 [apim.analytics]
@@ -234,6 +234,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn
 remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }}
 {{- end }}
 
+{{- if .Values.wso2.apim.configurations.jmx.enabled }}
+[monitoring.jmx]
+rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+{{- end }}
+
 [transport.passthru_https.sender.parameters]
 HostnameVerifier = {{ .Values.wso2.apim.configurations.transport.passthru_https.sender.parameters.hostnameVerifier | quote }}
 
diff --git a/distributed/gateway/confs/log4j2.properties b/distributed/gateway/confs/log4j2.properties
index f3751061..d420cd09 100644
--- a/distributed/gateway/confs/log4j2.properties
+++ b/distributed/gateway/confs/log4j2.properties
@@ -6,6 +6,10 @@ appenders = {{ .Values.wso2.apim.log4j2.appenders }}, CARBON_CONSOLE,HTTP_ACCESS
 appenders = CARBON_CONSOLE,HTTP_ACCESS_CONSOLE,AUDIT_CONSOLE,TRANSACTION_CONSOLE,CORRELATION_CONSOLE,CARBON_LOGFILE,AUDIT_LOGFILE,ATOMIKOS_LOGFILE,CARBON_TRACE_LOGFILE,ERROR_LOGFILE,OPEN_TRACING,SERVICE_APPENDER,TRACE_APPENDER,osgi,CORRELATION,BOTDATA_APPENDER,API_LOGFILE, APIM_GATEWAY_ACCESS_APPENDER
 {{- end }}
 
+{{- if .Values.wso2.apim.log4j2.appendersConfig }}
+{{ .Values.wso2.apim.log4j2.appendersConfig }}
+{{- end }}
+
 # CARBON_CONSOLE is set to be a ConsoleAppender using a PatternLayout.
 appender.CARBON_CONSOLE.type = Console
 appender.CARBON_CONSOLE.name = CARBON_CONSOLE
@@ -268,6 +272,10 @@ loggers = {{ .Values.wso2.apim.log4j2.loggers }}, AUDIT_LOG, trace-messages, org
 loggers = AUDIT_LOG, trace-messages, org-apache-coyote, com-hazelcast, Owasp-CsrfGuard, org-apache-axis2-wsdl-codegen-writer-PrettyPrinter, org-apache-axis2-clustering, org-apache-catalina, org-apache-tomcat, org-wso2-carbon-apacheds, org-apache-directory-server-ldap, org-apache-directory-server-core-event, com-atomikos, org-quartz, org-apache-jackrabbit-webdav, org-apache-juddi, org-apache-commons-digester-Digester, org-apache-jasper-compiler-TldLocationsCache, org-apache-qpid, org-apache-qpid-server-Main, qpid-message, qpid-message-broker-listening, org-apache-tiles, org-apache-commons-httpclient, org-apache-solr, me-prettyprint-cassandra-hector-TimingLogger, org-apache-axis-enterprise, org-apache-directory-shared-ldap, org-apache-directory-server-ldap-handlers, org-apache-directory-shared-ldap-entry-DefaultServerAttribute, org-apache-directory-server-core-DefaultDirectoryService, org-apache-directory-shared-ldap-ldif-LdifReader, org-apache-directory-server-ldap-LdapProtocolHandler, org-apache-directory-server-core, org-apache-directory-server-ldap-LdapSession, DataNucleus, Datastore, Datastore-Schema, JPOX-Datastore, JPOX-Plugin, JPOX-MetaData, JPOX-Query, JPOX-General, JPOX-Enhancer, org-apache-hadoop-hive, hive, ExecMapper, ExecReducer, net-sf-ehcache-config-ConfigurationFactory, axis2Deployment, equinox, tomcat2, StAXDialectDetector, trace, synapse, synapse_transport, axis2, axis2_transport, org-wso2-carbon, hunsicker, thrift-publisher, service_logger, trace_logger, org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator, correlation, GatewayAccessLogger
 {{- end }}
 
+{{- if .Values.wso2.apim.log4j2.loggersConfig }}
+{{ .Values.wso2.apim.log4j2.loggersConfig }}
+{{- end }}
+
 logger.API_LOG.name = API_LOG
 logger.API_LOG.level = INFO
 logger.API_LOG.appenderRef.API_LOGFILE.ref = API_LOGFILE
diff --git a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml
index e6f34154..c24a8d1b 100644
--- a/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml
+++ b/distributed/gateway/templates/gateway/wso2am-gateway-deployment.yaml
@@ -15,7 +15,9 @@ metadata:
   name: {{ template "apim-helm-gw.fullname" . }}-deployment
   namespace: {{ .Release.Namespace }}
 spec:
+  {{- if not .Values.wso2.deployment.hpa.enabled }}
   replicas: {{ .Values.wso2.deployment.replicas }}
+  {{- end }}
   strategy:
     rollingUpdate:
       maxSurge: {{ .Values.wso2.deployment.strategy.rollingUpdate.maxSurge }}
@@ -60,6 +62,8 @@ spec:
       {{- else if .Values.azure.enabled }}
       serviceAccount: {{ .Values.azure.serviceAccountName }}
       {{- end }}
+      {{- else if .Values.wso2.deployment.serviceAccountName }}
+      serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }}
       {{- end }}
       securityContext:
         seccompProfile:
@@ -67,14 +71,23 @@ spec:
           {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }}
           localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }}
           {{- end }}
-      {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }}
       imagePullSecrets:
-      - name: {{ template "apim-helm-gw.fullname" . }}-docker-registry-auth
-      {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }}
+        - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth
+        {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- end }}
       containers:
       - name: wso2am-gateway
+        {{ if .Values.wso2.deployment.image.tag }}
+        image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }}
+        {{- else }}
         image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }}
-        imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }}
+        {{- end }}
+        imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }}
         env:
         - name: PROFILE_NAME
           value: gateway-worker
@@ -85,6 +98,12 @@ spec:
               fieldPath: status.podIP
         - name: JVM_MEM_OPTS
           value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}"
+        {{- if .Values.wso2.deployment.envs }}
+        {{- range $name, $value := .Values.wso2.deployment.envs }}
+        - name: {{ $name }}
+          value: {{ $value | quote }}
+        {{- end }}
+        {{- end }}
         {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }}
         - name: WSO2_ADMIN_PASSWORD
           valueFrom:
@@ -175,6 +194,12 @@ spec:
           protocol: TCP
         - containerPort: {{ add 8021 .Values.wso2.apim.portOffset }}
           protocol: TCP
+        {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+        - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+          protocol: "TCP"
+        - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+          protocol: "TCP"
+        {{- end }}
         volumeMounts:
         - name: wso2am-gateway-conf
           mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml
diff --git a/distributed/gateway/templates/gateway/wso2am-gateway-hpa.yaml b/distributed/gateway/templates/gateway/wso2am-gateway-hpa.yaml
index f802db35..e5ca296f 100644
--- a/distributed/gateway/templates/gateway/wso2am-gateway-hpa.yaml
+++ b/distributed/gateway/templates/gateway/wso2am-gateway-hpa.yaml
@@ -9,6 +9,7 @@
 #
 # --------------------------------------------------------------------------------------
 
+{{ if .Values.wso2.deployment.hpa.enabled }}
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
@@ -18,18 +19,19 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: {{ template "apim-helm-gw.fullname" . }}-deployment
-  minReplicas: {{ .Values.wso2.deployment.minReplicas }}
-  maxReplicas: {{ .Values.wso2.deployment.maxReplicas }}
+  minReplicas: {{ .Values.wso2.deployment.hpa.minReplicas }}
+  maxReplicas: {{ .Values.wso2.deployment.hpa.maxReplicas }}
   metrics:
     - type: Resource
       resource:
         name: cpu
         target:
           type: Utilization
-          averageUtilization: {{ .Values.wso2.deployment.cpuUtilizationPercentage }}
+          averageUtilization: {{ .Values.wso2.deployment.hpa.cpuUtilizationPercentage }}
     - type: Resource
       resource:
         name: memory
         target:
           type: Utilization
-          averageUtilization: {{ .Values.wso2.deployment.memoryUtilizationPercentage }}
+          averageUtilization: {{ .Values.wso2.deployment.hpa.memoryUtilizationPercentage }}
+{{ end }}
diff --git a/distributed/gateway/templates/gateway/wso2am-gateway-service.yaml b/distributed/gateway/templates/gateway/wso2am-gateway-service.yaml
index 2f0758b0..31c6fcaf 100644
--- a/distributed/gateway/templates/gateway/wso2am-gateway-service.yaml
+++ b/distributed/gateway/templates/gateway/wso2am-gateway-service.yaml
@@ -44,3 +44,11 @@ spec:
     - name: websub-secure
       protocol: TCP
       port: {{ add 8021 .Values.wso2.apim.portOffset }}
+    {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+    - name: jmx-registry-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+    - name: jmx-server-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+    {{- end }}
diff --git a/distributed/gateway/values.yaml b/distributed/gateway/values.yaml
index fb3cc957..578b8aee 100644
--- a/distributed/gateway/values.yaml
+++ b/distributed/gateway/values.yaml
@@ -170,11 +170,31 @@ wso2:
     secureVaultEnabled: false
     # Logging related configurations
     log4j2:
-        # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE
+        # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE or loggers defined in loggersConfig. This should be a comma separated string. For example, if you want to enable audit log and http access log in the console, you can specify the following:
         loggers: ""
+        # example
+        # loggers: "AUDIT_LOG_CONSOLE,HTTP_ACCESS_CONSOLE, gateway-debug"
+        # -- Custom loggers that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a logger named "gateway-debug" with DEBUG level, you can specify the following:
+        loggersConfig: ""        
+        # example
+        # loggersConfig: |
+        #   # -- Add custom loggers to log4j2.properties. This will be added under the Loggers section of log4j2.properties
+        #   logger.gateway-debug.name = org.wso2.carbon.apimgt.gateway
+        #   logger.gateway-debug.level = DEBUG
 
-        # -- Appenders
+        # -- Appenders that can be enabled. Allowed values are appenders defined in appendersConfig. This should be a comma separated string. For example, if you want to enable a file appender named "GatewayFileAppender", you can specify the following:
+        # appenders: "GatewayFileAppender"
         appenders: ""
+
+        # -- Custom appenders that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a file appender named "GatewayFileAppender" that logs gateway logs to a file, you can specify the following:
+        # appendersConfig: |
+        #   # -- Add custom appenders to log4j2.properties. This will be added under the Appenders section of log4j2.properties
+        #   appender.GatewayFileAppender.type = File
+        #   appender.GatewayFileAppender.name = GatewayFileAppender
+        #   appender.GatewayFileAppender.fileName = /home/wso2carbon/logs/gateway.log
+        #   appender.GatewayFileAppender.layout.type = PatternLayout
+        #   appender.GatewayFileAppender.layout.pattern = [%d] %p %c - %m%n
+        appendersConfig: ""
     # -- Port Offset for APIM deployment
     portOffset: 0
     # -- Startup arguments for APIM
@@ -317,8 +337,8 @@ wso2:
         servicePort: 9443
         # -- Traffic manager service urls. You only need to define one if the TM is not in HA.
         urls:
-          - "wso2am-cp-1-service"
-          - "wso2am-cp-2-service"
+          - "wso2am-cp-1-service:5672"
+          - "wso2am-cp-2-service:5672"
         # -- Enable unlimited throttling tier
         unlimitedTier: true
         # -- Enable header based throttling
@@ -407,6 +427,11 @@ wso2:
         hostname: ""
         # -- Remote tracer port
         port: ""
+      # JMX
+      jmx:
+        enabled: false
+        rmiRegistryPort: 9999
+        rmiServerPort: 11111
 
       transport:
         passthru_https:
@@ -427,8 +452,10 @@ wso2:
     # Container image configurations
     image:
       # -- Container registry credentials.
-      # Specify image pull secrets for private registries
       imagePullSecrets:
+        # Specify image pull secrets for private registries
+        secrets: []
+        # Specify private registry credentials (upload credentials to values is not recommended)
         enabled: false
         username: ""
         password: ""
@@ -436,6 +463,8 @@ wso2:
       registry: ""
       # -- Azure ACR repository name consisting the image
       repository: ""
+      # -- Docker image tag: if specified, digest is ignored
+      tag: ""
       # -- Docker image digest
       digest: ""
       # -- Refer to the Kubernetes documentation on updating images (https://kubernetes.io/docs/concepts/containers/images/#updating-images)
@@ -461,6 +490,12 @@ wso2:
           # -- JVM heap memory Xmx
           xmx: "2048m"
 
+    # Custom environment variables for the container
+    envs: {}
+    # envs:
+    #   TZ: "Europe/Paris"
+    #   OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService"
+
     # Kubernetes Probes
     # Indicates whether the container starting
     startupProbe:
@@ -495,14 +530,17 @@ wso2:
     # Number of deployment replicas
     replicas: 2
     # HPA configurations
-    # -- Minimum replicas for HPA
-    minReplicas: 2
-    # -- Maximum replicas for HPA
-    maxReplicas: 3
-    # -- Target CPU utilization percentage for HPA
-    cpuUtilizationPercentage: 75
-    # -- Target memory utilization percentage for HPA
-    memoryUtilizationPercentage: 75
+    hpa:
+      enabled: false
+      # -- Minimum replicas for HPA
+      minReplicas: 2
+      # -- Maximum replicas for HPA
+      maxReplicas: 3
+      # -- Target CPU utilization percentage for HPA
+      cpuUtilizationPercentage: 75
+      # -- Target memory utilization percentage for HPA
+      memoryUtilizationPercentage: 75
+
     # -- Minimum available pod counts for PDB
     minAvailable: "50%"
 
@@ -521,3 +559,7 @@ wso2:
         maxSurge: 2
         # The maximum number of pods that can be unavailable during the update
         maxUnavailable: 0
+
+
+    # -- Use a kubernetes serviceAccount. If empty will use default sa.
+    serviceAccountName: ""
diff --git a/distributed/key-manager/Chart.yaml b/distributed/key-manager/Chart.yaml
index c4f5db7d..93d3ac14 100644
--- a/distributed/key-manager/Chart.yaml
+++ b/distributed/key-manager/Chart.yaml
@@ -13,5 +13,5 @@ apiVersion: v1
 appVersion: "4.5.0"
 description: A Helm chart for the deployment of WSO2 API Manager all-in-one distribution.
 name: wso2am-km
-version: 4.5.0-8
+version: 4.5.0-9
 icon: https://wso2.cachefly.net/wso2/sites/all/images/wso2logo.svg
diff --git a/distributed/key-manager/confs/deployment.toml b/distributed/key-manager/confs/deployment.toml
index 64e382dc..503ee064 100644
--- a/distributed/key-manager/confs/deployment.toml
+++ b/distributed/key-manager/confs/deployment.toml
@@ -147,6 +147,12 @@ apim_db_password = {{ .Values.wso2.apim.configurations.databases.apim_db.passwor
 shared_db_password = {{ .Values.wso2.apim.configurations.databases.shared_db.password | quote}}
 {{- end}}
 
+{{- if .Values.wso2.apim.configurations.jmx.enabled }}
+[monitoring.jmx]
+rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+{{- end }}
+
 {{- if .Values.wso2.apim.configurations.extraConfigs }}
 {{ .Values.wso2.apim.configurations.extraConfigs }}
 {{- end }}
diff --git a/distributed/key-manager/confs/log4j2.properties b/distributed/key-manager/confs/log4j2.properties
index ea80d563..04855858 100644
--- a/distributed/key-manager/confs/log4j2.properties
+++ b/distributed/key-manager/confs/log4j2.properties
@@ -6,6 +6,10 @@ appenders = {{ .Values.wso2.apim.log4j2.appenders }}, CARBON_CONSOLE,HTTP_ACCESS
 appenders = CARBON_CONSOLE,HTTP_ACCESS_CONSOLE,AUDIT_CONSOLE,TRANSACTION_CONSOLE,CORRELATION_CONSOLE,CARBON_LOGFILE,AUDIT_LOGFILE,ATOMIKOS_LOGFILE,CARBON_TRACE_LOGFILE,ERROR_LOGFILE,OPEN_TRACING,SERVICE_APPENDER,TRACE_APPENDER,osgi,CORRELATION,BOTDATA_APPENDER,API_LOGFILE,APIM_GATEWAY_ACCESS_APPENDER
 {{- end }}
 
+{{- if .Values.wso2.apim.log4j2.appendersConfig }}
+{{ .Values.wso2.apim.log4j2.appendersConfig }}
+{{- end }}
+
 # CARBON_CONSOLE is set to be a ConsoleAppender using a PatternLayout.
 appender.CARBON_CONSOLE.type = Console
 appender.CARBON_CONSOLE.name = CARBON_CONSOLE
@@ -207,6 +211,10 @@ loggers = {{ .Values.wso2.apim.log4j2.loggers }}, AUDIT_LOG, trace-messages, org
 loggers = AUDIT_LOG, trace-messages, org-apache-coyote, com-hazelcast, Owasp-CsrfGuard, org-apache-axis2-wsdl-codegen-writer-PrettyPrinter, org-apache-axis2-clustering, org-apache-catalina, org-apache-tomcat, org-wso2-carbon-apacheds, org-apache-directory-server-ldap, org-apache-directory-server-core-event, com-atomikos, org-quartz, org-apache-jackrabbit-webdav, org-apache-juddi, org-apache-commons-digester-Digester, org-apache-jasper-compiler-TldLocationsCache, org-apache-qpid, org-apache-qpid-server-Main, qpid-message, qpid-message-broker-listening, org-apache-tiles, org-apache-commons-httpclient, org-apache-solr, me-prettyprint-cassandra-hector-TimingLogger, org-apache-axis-enterprise, org-apache-directory-shared-ldap, org-apache-directory-server-ldap-handlers, org-apache-directory-shared-ldap-entry-DefaultServerAttribute, org-apache-directory-server-core-DefaultDirectoryService, org-apache-directory-shared-ldap-ldif-LdifReader, org-apache-directory-server-ldap-LdapProtocolHandler, org-apache-directory-server-core, org-apache-directory-server-ldap-LdapSession, DataNucleus, Datastore, Datastore-Schema, JPOX-Datastore, JPOX-Plugin, JPOX-MetaData, JPOX-Query, JPOX-General, JPOX-Enhancer, org-apache-hadoop-hive, hive, ExecMapper, ExecReducer, net-sf-ehcache-config-ConfigurationFactory, axis2Deployment, equinox, tomcat2, StAXDialectDetector, trace, synapse, synapse_transport, axis2, axis2_transport, org-wso2-carbon, hunsicker, thrift-publisher, service_logger, trace_logger, org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator, correlation, GatewayAccessLogger
 {{- end }}
 
+{{- if .Values.wso2.apim.log4j2.loggersConfig }}
+{{ .Values.wso2.apim.log4j2.loggersConfig }}
+{{- end }}
+
 logger.API_LOG.name = API_LOG
 logger.API_LOG.level = INFO
 logger.API_LOG.appenderRef.API_LOGFILE.ref = API_LOGFILE
diff --git a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml
index 8c1661bb..fd1c7e72 100644
--- a/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml
+++ b/distributed/key-manager/templates/key-manager/wso2am-km-deployment.yaml
@@ -64,6 +64,8 @@ spec:
       {{- else if .Values.azure.enabled }}
       serviceAccount: {{ .Values.azure.serviceAccountName }}
       {{- end }}
+      {{- else if .Values.wso2.deployment.serviceAccountName }}
+      serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }}
       {{- end }}
       securityContext:
         seccompProfile:
@@ -71,14 +73,23 @@ spec:
           {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }}
           localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }}
           {{- end }}
-      {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }}
       imagePullSecrets:
-      - name: {{ template "apim-helm-km.fullname" . }}-docker-registry-auth
-      {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }}
+        - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth
+        {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- end }}
       containers:
       - name: wso2am-km
+        {{ if .Values.wso2.deployment.image.tag }}
+        image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }}
+        {{- else }}
         image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }}
-        imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }}
+        {{- end }}
+        imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }}
         env:
         - name: PROFILE_NAME
           value: key-manager
@@ -89,6 +100,12 @@ spec:
               fieldPath: status.podIP
         - name: JVM_MEM_OPTS
           value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}"
+        {{- if .Values.wso2.deployment.envs }}
+        {{- range $name, $value := .Values.wso2.deployment.envs }}
+        - name: {{ $name }}
+          value: {{ $value | quote }}
+        {{- end }}
+        {{- end }}
         {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }}
         - name: WSO2_ADMIN_PASSWORD
           valueFrom:
@@ -157,6 +174,12 @@ spec:
           protocol: TCP
         - containerPort: {{ add 9443 .Values.wso2.apim.portOffset }}
           protocol: TCP
+        {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+        - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+          protocol: "TCP"
+        - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+          protocol: "TCP"
+        {{- end }}
         volumeMounts:
         - name: wso2am-km-conf
           mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml
diff --git a/distributed/key-manager/templates/key-manager/wso2am-km-service.yaml b/distributed/key-manager/templates/key-manager/wso2am-km-service.yaml
index becb457d..90724949 100644
--- a/distributed/key-manager/templates/key-manager/wso2am-km-service.yaml
+++ b/distributed/key-manager/templates/key-manager/wso2am-km-service.yaml
@@ -26,3 +26,11 @@ spec:
     - name: servlet-https
       protocol: TCP
       port: {{ add 9443 .Values.wso2.apim.portOffset }}
+    {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+    - name: jmx-registry-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+    - name: jmx-server-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+    {{- end }}
diff --git a/distributed/key-manager/values.yaml b/distributed/key-manager/values.yaml
index 04cb535d..40d1ca77 100644
--- a/distributed/key-manager/values.yaml
+++ b/distributed/key-manager/values.yaml
@@ -147,10 +147,31 @@ wso2:
     secureVaultEnabled: false
     # Logging related configurations
     log4j2:
-        # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE
+        # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE or loggers defined in loggersConfig. This should be a comma separated string. For example, if you want to enable audit log and http access log in the console, you can specify the following:
         loggers: ""
-        # -- Appenders
+        # example
+        # loggers: "AUDIT_LOG_CONSOLE,HTTP_ACCESS_CONSOLE, gateway-debug"
+        # -- Custom loggers that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a logger named "gateway-debug" with DEBUG level, you can specify the following:
+        loggersConfig: ""        
+        # example
+        # loggersConfig: |
+        #   # -- Add custom loggers to log4j2.properties. This will be added under the Loggers section of log4j2.properties
+        #   logger.gateway-debug.name = org.wso2.carbon.apimgt.gateway
+        #   logger.gateway-debug.level = DEBUG
+
+        # -- Appenders that can be enabled. Allowed values are appenders defined in appendersConfig. This should be a comma separated string. For example, if you want to enable a file appender named "GatewayFileAppender", you can specify the following:
+        # appenders: "GatewayFileAppender"
         appenders: ""
+
+        # -- Custom appenders that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a file appender named "GatewayFileAppender" that logs gateway logs to a file, you can specify the following:
+        # appendersConfig: |
+        #   # -- Add custom appenders to log4j2.properties. This will be added under the Appenders section of log4j2.properties
+        #   appender.GatewayFileAppender.type = File
+        #   appender.GatewayFileAppender.name = GatewayFileAppender
+        #   appender.GatewayFileAppender.fileName = /home/wso2carbon/logs/gateway.log
+        #   appender.GatewayFileAppender.layout.type = PatternLayout
+        #   appender.GatewayFileAppender.layout.pattern = [%d] %p %c - %m%n
+        appendersConfig: ""
     # -- Startup arguments for APIM
     startupArgs: ""
     # -- Port Offset for APIM deployment
@@ -267,6 +288,8 @@ wso2:
         urls:
           - "wso2am-cp-1-service"
           - "wso2am-cp-2-service"
+        # -- Port Offset for APIM deployment
+        portOffset: 0
 
       # APIM OAuth configurations
       oauth_config:
@@ -297,6 +320,11 @@ wso2:
         hostname: ""
         # -- Remote tracer port
         port: ""
+      # JMX
+      jmx:
+        enabled: false
+        rmiRegistryPort: 9999
+        rmiServerPort: 11111
 
       # -- Add custom configurations to deployment.toml.
       extraConfigs:
@@ -305,8 +333,10 @@ wso2:
     # Container image configurations
     image:
       # -- Container registry credentials.
-      # Specify image pull secrets for private registries
       imagePullSecrets:
+        # Specify image pull secrets for private registries
+        secrets: []
+        # Specify private registry credentials (upload credentials to values is not recommended)
         enabled: false
         username: ""
         password: ""
@@ -314,6 +344,8 @@ wso2:
       registry: ""
       # -- Azure ACR repository name consisting the image
       repository: ""
+      # -- Docker image tag: if specified, digest is ignored
+      tag: ""
       # -- Docker image digest
       digest: ""
       # -- Refer to the Kubernetes documentation on updating images (https://kubernetes.io/docs/concepts/containers/images/#updating-images)
@@ -339,6 +371,12 @@ wso2:
           # -- JVM heap memory Xmx
           xmx: "2048m"
 
+    # Custom environment variables for the container
+    envs: {}
+    # envs:
+    #   TZ: "Europe/Paris"
+    #   OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService"
+
     # Kubernetes Probes
     # Indicates whether the container is running
     livenessProbe:
@@ -386,3 +424,6 @@ wso2:
 
     # -- Enable high availability for key manager. If this is enabled, two key manager replicas will be deployed.
     highAvailability: false
+
+    # -- Use a kubernetes serviceAccount. If empty will use default sa.
+    serviceAccountName: ""
diff --git a/distributed/traffic-manager/Chart.yaml b/distributed/traffic-manager/Chart.yaml
index 8853f9c2..ff31a750 100644
--- a/distributed/traffic-manager/Chart.yaml
+++ b/distributed/traffic-manager/Chart.yaml
@@ -13,5 +13,5 @@ apiVersion: v1
 appVersion: "4.5.0"
 description: A Helm chart for the deployment of WSO2 API Management Traffic Manager profile
 name: wso2am-tm
-version: 4.5.0-8
+version: 4.5.0-9
 icon: https://wso2.cachefly.net/wso2/sites/all/images/wso2logo.svg
diff --git a/distributed/traffic-manager/confs/instance-1/deployment.toml b/distributed/traffic-manager/confs/instance-1/deployment.toml
index 7b2dda2b..49a32a1e 100644
--- a/distributed/traffic-manager/confs/instance-1/deployment.toml
+++ b/distributed/traffic-manager/confs/instance-1/deployment.toml
@@ -110,9 +110,9 @@ password = {{ .Values.wso2.apim.configurations.security.truststore.password | qu
 [apim.key_manager]
 {{- if .Values.wso2.apim.configurations.iskm.enabled }}
 type = "WSO2-IS"
-service_url = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:9443/services/"
+service_url = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/services/"
 {{- else }}
-service_url = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:9443/services/"
+service_url = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/services/"
 {{- end }}
 
 {{- if .Values.wso2.deployment.highAvailability}}
@@ -127,15 +127,15 @@ throttle_decision_endpoints = ["tcp://localhost:5672"]
 enable = true
 username = "$ref{super_admin.username}"
 password = "$ref{super_admin.password}"
-service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:9443/services/"
+service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:{{ .Values.wso2.apim.configurations.eventhub.servicePort }}/services/"
 {{- $len := add (len .Values.wso2.apim.configurations.eventhub.urls) -1 }}
-event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}:5672"{{ if ne $index $len }},{{ end }}{{ end}}]
+event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}"{{ if ne $index $len }},{{ end }}{{ end}}]
 
 [apim.oauth_config]
 {{- if .Values.wso2.apim.configurations.iskm.enabled }}
-revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:9443/oauth2/revoke"
+revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/oauth2/revoke"
 {{- else }}
-revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:9443/oauth2/revoke"
+revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/oauth2/revoke"
 {{- end }}
 enable_token_encryption = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenEncryption }}
 enable_token_hashing = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenHashing }}
@@ -156,6 +156,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn
 remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }}
 {{- end }}
 
+{{- if .Values.wso2.apim.configurations.jmx.enabled }}
+[monitoring.jmx]
+rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+{{- end }}
+
 [transport.https.properties]
 proxyPort = 443
 
diff --git a/distributed/traffic-manager/confs/instance-2/deployment.toml b/distributed/traffic-manager/confs/instance-2/deployment.toml
index 6be3ad73..e63e42d2 100644
--- a/distributed/traffic-manager/confs/instance-2/deployment.toml
+++ b/distributed/traffic-manager/confs/instance-2/deployment.toml
@@ -110,9 +110,9 @@ password = {{ .Values.wso2.apim.configurations.security.truststore.password | qu
 [apim.key_manager]
 {{- if .Values.wso2.apim.configurations.iskm.enabled }}
 type = "WSO2-IS"
-service_url = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:9443/services/"
+service_url = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/services/"
 {{- else }}
-service_url = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:9443/services/"
+service_url = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/services/"
 {{- end }}
 
 # Traffic Manager configurations
@@ -125,15 +125,15 @@ throttle_decision_endpoints = ["tcp://localhost:5672"]
 enable = true
 username = "$ref{super_admin.username}"
 password = "$ref{super_admin.password}"
-service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:9443/services/"
+service_url = "https://{{ .Values.wso2.apim.configurations.eventhub.serviceUrl }}:{{ .Values.wso2.apim.configurations.eventhub.servicePort }}/services/"
 {{- $len := add (len .Values.wso2.apim.configurations.eventhub.urls) -1 }}
-event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}:5672"{{ if ne $index $len }},{{ end }}{{ end}}]
+event_listening_endpoints = [{{ range $index, $element := .Values.wso2.apim.configurations.eventhub.urls }}"tcp://{{ $element }}"{{ if ne $index $len }},{{ end }}{{ end}}]
 
 [apim.oauth_config]
 {{- if .Values.wso2.apim.configurations.iskm.enabled }}
-revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:9443/oauth2/revoke"
+revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.iskm.serviceName }}:{{ .Values.wso2.apim.configurations.iskm.servicePort }}/oauth2/revoke"
 {{- else }}
-revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:9443/oauth2/revoke"
+revoke_endpoint = "https://{{ .Values.wso2.apim.configurations.km.serviceUrl }}:{{ .Values.wso2.apim.configurations.km.servicePort }}/oauth2/revoke"
 {{- end }}
 enable_token_encryption = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenEncryption }}
 enable_token_hashing = {{ .Values.wso2.apim.configurations.oauth_config.enableTokenHashing }}
@@ -154,6 +154,12 @@ remote_tracer.hostname = {{ .Values.wso2.apim.configurations.openTelemetry.hostn
 remote_tracer.port = {{ .Values.wso2.apim.configurations.openTelemetry.port | quote }}
 {{- end }}
 
+{{- if .Values.wso2.apim.configurations.jmx.enabled }}
+[monitoring.jmx]
+rmi_registry_port = {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+rmi_server_port = {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+{{- end }}
+
 [transport.https.properties]
 proxyPort = 443
 
diff --git a/distributed/traffic-manager/confs/log4j2.properties b/distributed/traffic-manager/confs/log4j2.properties
index e0b193be..d24af7fb 100644
--- a/distributed/traffic-manager/confs/log4j2.properties
+++ b/distributed/traffic-manager/confs/log4j2.properties
@@ -6,6 +6,10 @@ appenders = {{ .Values.wso2.apim.log4j2.appenders }}, CARBON_CONSOLE,HTTP_ACCESS
 appenders = CARBON_CONSOLE,HTTP_ACCESS_CONSOLE,AUDIT_CONSOLE,TRANSACTION_CONSOLE,CORRELATION_CONSOLE,CARBON_LOGFILE,AUDIT_LOGFILE,ATOMIKOS_LOGFILE,CARBON_TRACE_LOGFILE,ERROR_LOGFILE,OPEN_TRACING,SERVICE_APPENDER,TRACE_APPENDER,osgi,CORRELATION,BOTDATA_APPENDER,API_LOGFILE,APIM_GATEWAY_ACCESS_APPENDER
 {{- end }}
 
+{{- if .Values.wso2.apim.log4j2.appendersConfig }}
+{{ .Values.wso2.apim.log4j2.appendersConfig }}
+{{- end }}
+
 # CARBON_CONSOLE is set to be a ConsoleAppender using a PatternLayout.
 appender.CARBON_CONSOLE.type = Console
 appender.CARBON_CONSOLE.name = CARBON_CONSOLE
@@ -207,6 +211,10 @@ loggers = {{ .Values.wso2.apim.log4j2.loggers }}, AUDIT_LOG, trace-messages, org
 loggers = AUDIT_LOG, trace-messages, org-apache-coyote, com-hazelcast, Owasp-CsrfGuard, org-apache-axis2-wsdl-codegen-writer-PrettyPrinter, org-apache-axis2-clustering, org-apache-catalina, org-apache-tomcat, org-wso2-carbon-apacheds, org-apache-directory-server-ldap, org-apache-directory-server-core-event, com-atomikos, org-quartz, org-apache-jackrabbit-webdav, org-apache-juddi, org-apache-commons-digester-Digester, org-apache-jasper-compiler-TldLocationsCache, org-apache-qpid, org-apache-qpid-server-Main, qpid-message, qpid-message-broker-listening, org-apache-tiles, org-apache-commons-httpclient, org-apache-solr, me-prettyprint-cassandra-hector-TimingLogger, org-apache-axis-enterprise, org-apache-directory-shared-ldap, org-apache-directory-server-ldap-handlers, org-apache-directory-shared-ldap-entry-DefaultServerAttribute, org-apache-directory-server-core-DefaultDirectoryService, org-apache-directory-shared-ldap-ldif-LdifReader, org-apache-directory-server-ldap-LdapProtocolHandler, org-apache-directory-server-core, org-apache-directory-server-ldap-LdapSession, DataNucleus, Datastore, Datastore-Schema, JPOX-Datastore, JPOX-Plugin, JPOX-MetaData, JPOX-Query, JPOX-General, JPOX-Enhancer, org-apache-hadoop-hive, hive, ExecMapper, ExecReducer, net-sf-ehcache-config-ConfigurationFactory, axis2Deployment, equinox, tomcat2, StAXDialectDetector, trace, synapse, synapse_transport, axis2, axis2_transport, org-wso2-carbon, hunsicker, thrift-publisher, service_logger, trace_logger, org-wso2-carbon-apimgt-gateway-mediators-BotDetectionMediator, correlation, GatewayAccessLogger
 {{- end }}
 
+{{- if .Values.wso2.apim.log4j2.loggersConfig }}
+{{ .Values.wso2.apim.log4j2.loggersConfig }}
+{{- end }}
+
 logger.API_LOG.name = API_LOG
 logger.API_LOG.level = INFO
 logger.API_LOG.appenderRef.API_LOGFILE.ref = API_LOGFILE
diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml
index e658ebba..b77beb5e 100644
--- a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml
+++ b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-deployment.yaml
@@ -62,6 +62,8 @@ spec:
       {{- else if .Values.azure.enabled }}
       serviceAccount: {{ .Values.azure.serviceAccountName }}
       {{- end }}
+      {{- else if .Values.wso2.deployment.serviceAccountName }}
+      serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }}
       {{- end }}
       securityContext:
         seccompProfile:
@@ -69,14 +71,23 @@ spec:
           {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }}
           localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }}
           {{- end }}
-      {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }}
       imagePullSecrets:
-      - name: {{ template "apim-helm-tm.fullname" . }}-docker-registry-auth
-      {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }}
+        - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth
+        {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- end }}
       containers:
       - name: wso2am-traffic-manager
+        {{ if .Values.wso2.deployment.image.tag }}
+        image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }}
+        {{- else }}
         image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }}
-        imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }}
+        {{- end }}
+        imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }}
         env:
         - name: PROFILE_NAME
           value: traffic-manager
@@ -87,6 +98,12 @@ spec:
               fieldPath: status.podIP
         - name: JVM_MEM_OPTS
           value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}"
+        {{- if .Values.wso2.deployment.envs }}
+        {{- range $name, $value := .Values.wso2.deployment.envs }}
+        - name: {{ $name }}
+          value: {{ $value | quote }}
+        {{- end }}
+        {{- end }}
         {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }}
         - name: WSO2_ADMIN_PASSWORD
           valueFrom:
@@ -170,6 +187,12 @@ spec:
             protocol: "TCP"
           - containerPort: 5672
             protocol: "TCP"
+          {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+          - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+            protocol: "TCP"
+          - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+            protocol: "TCP"
+          {{- end }}
         volumeMounts:
         - name: wso2am-traffic-manager-conf
           mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml
diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-service.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-service.yaml
index 048d2de7..c84208fc 100644
--- a/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-service.yaml
+++ b/distributed/traffic-manager/templates/traffic-manager/instance-1/wso2am-tm-service.yaml
@@ -33,3 +33,11 @@ spec:
     - name: servlet-https
       protocol: TCP
       port: 9443
+    {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+    - name: jmx-registry-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+    - name: jmx-server-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+    {{- end }}
diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml
index f5d9d543..16635fc3 100644
--- a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml
+++ b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-deployment.yaml
@@ -63,6 +63,8 @@ spec:
       {{- else if .Values.azure.enabled }}
       serviceAccount: {{ .Values.azure.serviceAccountName }}
       {{- end }}
+      {{- else if .Values.wso2.deployment.serviceAccountName }}
+      serviceAccount: {{ .Values.wso2.deployment.serviceAccountName }}
       {{- end }}
       securityContext:
         seccompProfile:
@@ -70,14 +72,23 @@ spec:
           {{- if eq .Values.kubernetes.securityContext.seccompProfile.type "Localhost" }}
           localhostProfile: {{ .Values.kubernetes.securityContext.seccompProfile.localhostProfile }}
           {{- end }}
-      {{- if and .Values.wso2.deployment.image.imagePullSecrets.enabled }}
       imagePullSecrets:
-      - name: {{ template "apim-helm-tm.fullname" . }}-docker-registry-auth
-      {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.enabled }}
+        - name: {{ template "apim-helm-cp.fullname" . }}-docker-registry-auth
+        {{- end }}
+        {{- if .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        {{- range .Values.wso2.deployment.image.imagePullSecrets.secrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- end }}
       containers:
       - name: wso2am-traffic-manager
+        {{ if .Values.wso2.deployment.image.tag }}
+        image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}:{{ .Values.wso2.deployment.image.tag }}
+        {{- else }}
         image: {{ .Values.wso2.deployment.image.registry }}/{{ .Values.wso2.deployment.image.repository }}@{{ .Values.wso2.deployment.image.digest }}
-        imagePullPolicy: {{ .Values.wso2.deployment.imagePullPolicy }}
+        {{- end }}
+        imagePullPolicy: {{ .Values.wso2.deployment.image.imagePullPolicy }}
         env:
         - name: PROFILE_NAME
           value: traffic-manager
@@ -88,6 +99,12 @@ spec:
               fieldPath: status.podIP
         - name: JVM_MEM_OPTS
           value: "-Xms{{ .Values.wso2.deployment.resources.jvm.memory.xms }} -Xmx{{ .Values.wso2.deployment.resources.jvm.memory.xmx }}"
+        {{- if .Values.wso2.deployment.envs }}
+        {{- range $name, $value := .Values.wso2.deployment.envs }}
+        - name: {{ $name }}
+          value: {{ $value | quote }}
+        {{- end }}
+        {{- end }}
         {{- if and .Values.wso2.apim.configurations.existingSecret.secretName .Values.wso2.apim.configurations.existingSecret.adminPasswordKey }}
         - name: WSO2_ADMIN_PASSWORD
           valueFrom:
@@ -171,6 +188,12 @@ spec:
             protocol: "TCP"
           - containerPort: 5672
             protocol: "TCP"
+          {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+          - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+            protocol: "TCP"
+          - containerPort: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+            protocol: "TCP"
+          {{- end }}
         volumeMounts:
         - name: wso2am-traffic-manager-conf
           mountPath: /home/wso2carbon/wso2-config-volume/repository/conf/deployment.toml
diff --git a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-service.yaml b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-service.yaml
index 270408b0..84e0a8ea 100644
--- a/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-service.yaml
+++ b/distributed/traffic-manager/templates/traffic-manager/instance-2/wso2am-tm-service.yaml
@@ -34,4 +34,12 @@ spec:
     - name: servlet-https
       protocol: TCP
       port: 9443
+    {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+    - name: jmx-registry-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+    - name: jmx-server-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+    {{- end }}
 {{- end }}
\ No newline at end of file
diff --git a/distributed/traffic-manager/templates/traffic-manager/wso2am-tm-service.yaml b/distributed/traffic-manager/templates/traffic-manager/wso2am-tm-service.yaml
index 4cd4c7ba..ee007014 100644
--- a/distributed/traffic-manager/templates/traffic-manager/wso2am-tm-service.yaml
+++ b/distributed/traffic-manager/templates/traffic-manager/wso2am-tm-service.yaml
@@ -26,3 +26,11 @@ spec:
     - name: servlet-https
       protocol: TCP
       port: 9443
+    {{- if .Values.wso2.apim.configurations.jmx.enabled }}
+    - name: jmx-registry-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiRegistryPort }}
+    - name: jmx-server-port
+      protocol: TCP
+      port: {{ .Values.wso2.apim.configurations.jmx.rmiServerPort }}
+    {{- end }}
diff --git a/distributed/traffic-manager/values.yaml b/distributed/traffic-manager/values.yaml
index 48b1f5ee..4f37baa5 100644
--- a/distributed/traffic-manager/values.yaml
+++ b/distributed/traffic-manager/values.yaml
@@ -125,10 +125,31 @@ wso2:
     secureVaultEnabled: false
     # Logging related configurations
     log4j2:
-        # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE
+        # -- Console loggers that can be enabled. Allowed values are AUDIT_LOG_CONSOLE, HTTP_ACCESS_CONSOLE, TRANSACTION_CONSOLE, CORRELATION_CONSOLE or loggers defined in loggersConfig. This should be a comma separated string. For example, if you want to enable audit log and http access log in the console, you can specify the following:
         loggers: ""
-        # -- Appenders
+        # example
+        # loggers: "AUDIT_LOG_CONSOLE,HTTP_ACCESS_CONSOLE, gateway-debug"
+        # -- Custom loggers that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a logger named "gateway-debug" with DEBUG level, you can specify the following:
+        loggersConfig: ""        
+        # example
+        # loggersConfig: |
+        #   # -- Add custom loggers to log4j2.properties. This will be added under the Loggers section of log4j2.properties
+        #   logger.gateway-debug.name = org.wso2.carbon.apimgt.gateway
+        #   logger.gateway-debug.level = DEBUG
+
+        # -- Appenders that can be enabled. Allowed values are appenders defined in appendersConfig. This should be a comma separated string. For example, if you want to enable a file appender named "GatewayFileAppender", you can specify the following:
+        # appenders: "GatewayFileAppender"
         appenders: ""
+
+        # -- Custom appenders that can be added to log4j2.properties. This should be in the format of log4j2 properties file without the Loggers/Appenders/Properties sections. For example, if you want to add a file appender named "GatewayFileAppender" that logs gateway logs to a file, you can specify the following:
+        # appendersConfig: |
+        #   # -- Add custom appenders to log4j2.properties. This will be added under the Appenders section of log4j2.properties
+        #   appender.GatewayFileAppender.type = File
+        #   appender.GatewayFileAppender.name = GatewayFileAppender
+        #   appender.GatewayFileAppender.fileName = /home/wso2carbon/logs/gateway.log
+        #   appender.GatewayFileAppender.layout.type = PatternLayout
+        #   appender.GatewayFileAppender.layout.pattern = [%d] %p %c - %m%n
+        appendersConfig: ""
     # -- Startup arguments for APIM
     startupArgs: ""
     # -- Startup script mount status
@@ -251,10 +272,12 @@ wso2:
       eventhub:
         # -- Event hub (control plane) loadbalancer service url
         serviceUrl: "wso2am-cp-service"
+        # -- Key Manager service port
+        servicePort: 9443
         # -- Event hub service urls
         urls:
-          - "wso2am-cp-1-service"
-          - "wso2am-cp-2-service"
+          - "wso2am-cp-1-service:5672"
+          - "wso2am-cp-2-service:5672"
 
       # APIM OAuth configurations
       oauth_config:
@@ -285,6 +308,11 @@ wso2:
         hostname: ""
         # -- Remote tracer port
         port: ""
+      # JMX
+      jmx:
+        enabled: false
+        rmiRegistryPort: 9999
+        rmiServerPort: 11111
 
       # -- Add custom configurations to deployment.toml.
       extraConfigs: 
@@ -293,8 +321,10 @@ wso2:
     # Container image configurations
     image:
       # -- Container registry credentials.
-      # Specify image pull secrets for private registries
-      imagePullSecrets:
+      imagePullSecrets: 
+        # -- Specify image pull secrets for private registries
+        secrets: []
+        # -- Specify private registry credentials (upload credentials to values is not recommended)
         enabled: false
         username: ""
         password: ""
@@ -302,6 +332,8 @@ wso2:
       registry: ""
       # -- Azure ACR repository name consisting the image
       repository: ""
+      # -- Docker image tag: if specified, digest is ignored
+      tag: ""
       # -- Docker image digest
       digest: ""
       # -- Refer to the Kubernetes documentation on updating images (https://kubernetes.io/docs/concepts/containers/images/#updating-images)
@@ -327,6 +359,12 @@ wso2:
           # -- JVM heap memory Xmx
           xmx: "2048m"
 
+    # Custom environment variables for the container
+    envs: {}
+    # envs:
+    #   TZ: "Europe/Paris"
+    #   OTEL_RESOURCE_ATTRIBUTES: "deployment.environment=Production,service.name=MyService"
+
     # Kubernetes Probes
     # Indicates whether the container starting
     startupProbe:
@@ -382,4 +420,7 @@ wso2:
 
     # -- Enable high availability for traffic manager. If this is enabled, two traffic manager instances will be deployed.
     # This is not relavant to HA in Kubernetes. Multiple replicas of the same instance will not count as HA for TM.
-    highAvailability: true
\ No newline at end of file
+    highAvailability: true
+
+    # -- Use a kubernetes serviceAccount. If empty will use default sa.
+    serviceAccountName: ""