diff --git a/charts/postgreslet/Chart.yaml b/charts/postgreslet/Chart.yaml
index 91ad93e..35533a5 100644
--- a/charts/postgreslet/Chart.yaml
+++ b/charts/postgreslet/Chart.yaml
@@ -21,4 +21,4 @@ version: 0.13.0-devel
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v0.13.1"
\ No newline at end of file
+appVersion: "v0.14.0"
\ No newline at end of file
diff --git a/charts/postgreslet/templates/configmap.yaml b/charts/postgreslet/templates/configmap.yaml
index a2a2a88..bc8e381 100644
--- a/charts/postgreslet/templates/configmap.yaml
+++ b/charts/postgreslet/templates/configmap.yaml
@@ -52,6 +52,8 @@ data:
   STANDBY_CLUSTERS_SOURCE_RANGES: {{ .Values.postgreslet.standbyClustersSourceRanges | quote  }}
   STORAGE_CLASS: {{ .Values.postgreslet.storageClass | quote  }}
   TENANT: {{ .Values.postgreslet.tenant | quote }}
+  TLS_CLUSTER_ISSUER: {{ .Values.postgreslet.tlsClusterIssuer | quote  }}
+  TLS_SUB_DOMAIN: {{ .Values.postgreslet.tlsSubDomain | quote  }}
 kind: ConfigMap
 metadata:
   name: {{ include "postgreslet.fullname" . }}
diff --git a/charts/postgreslet/values.yaml b/charts/postgreslet/values.yaml
index cd257b8..9285504 100644
--- a/charts/postgreslet/values.yaml
+++ b/charts/postgreslet/values.yaml
@@ -7,7 +7,7 @@ replicaCount: 1
 image:
   repository: r.metal-stack.io/postgreslet
   pullPolicy: IfNotPresent
-  tag: "v0.13.1"
+  tag: "v0.14.0"
 
 imagePullSecrets: []
 nameOverride: ""
@@ -136,6 +136,10 @@ postgreslet:
   enableRandomStorageEncrytionSecret: false
   # enableBootsrtapStandbyFromS3 enables the bootstrapping of remote standby clusters via S3 instead of pgbasebackup
   enableBootsrtapStandbyFromS3: true
+  # tlsClusterIssuer An existing cert-manager Cluster Issuer to use when requesting TLS certificates per database instance. The startup of the postgres pod will fail if an issuer is configured but not working.
+  tlsClusterIssuer: ""
+  # tlsSubDomain when enabled, uses the given subdomain (in combination with the postgres instance's UUID) as common name when requesting the certificate
+  tlsSubDomain: ""
 
 # addRandomLabel adds a random label each time the deployment.yaml is rendered, forcing k8s to update that deployment.
 # In combination with image.PullPolicy=Always, this effetifely forces a reload of the pod, even if the image tag stays the same.