diff --git a/src/main/ks-installer/Chart.yaml b/src/main/ks-installer/Chart.yaml
index d50e766e..9351d72d 100644
--- a/src/main/ks-installer/Chart.yaml
+++ b/src/main/ks-installer/Chart.yaml
@@ -18,9 +18,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.3.1
+version: 0.3.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 3.2.1
+appVersion: 3.3.0
diff --git a/src/main/ks-installer/templates/clusterrole.yaml b/src/main/ks-installer/templates/clusterrole.yaml
index bde94b34..69b41d4f 100644
--- a/src/main/ks-installer/templates/clusterrole.yaml
+++ b/src/main/ks-installer/templates/clusterrole.yaml
@@ -6,192 +6,204 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - apps
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - extensions
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - batch
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - apiregistration.k8s.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - apiextensions.k8s.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - tenant.kubesphere.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - certificates.k8s.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - devops.kubesphere.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - monitoring.coreos.com
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - logging.kubesphere.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - jaegertracing.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - storage.k8s.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - admissionregistration.k8s.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - policy
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - autoscaling
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - networking.istio.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - config.istio.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - iam.kubesphere.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - notification.kubesphere.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - auditing.kubesphere.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - events.kubesphere.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - core.kubefed.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - installer.kubesphere.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
       - storage.kubesphere.io
     resources:
-      - '*'
+      - "*"
     verbs:
-      - '*'
+      - "*"
   - apiGroups:
-    - security.istio.io
+      - security.istio.io
     resources:
-    - '*'
+      - "*"
     verbs:
-    - '*'
+      - "*"
   - apiGroups:
-    - monitoring.kiali.io
+      - monitoring.kiali.io
     resources:
-    - '*'
+      - "*"
     verbs:
-    - '*'
+      - "*"
   - apiGroups:
-    - kiali.io
+      - kiali.io
     resources:
-    - '*'
+      - "*"
     verbs:
-    - '*'
+      - "*"
   - apiGroups:
-    - networking.k8s.io
+      - networking.k8s.io
     resources:
-    - '*'
+      - "*"
     verbs:
-    - '*'
+      - "*"
   - apiGroups:
-    - kubeedge.kubesphere.io
+      - edgeruntime.kubesphere.io
     resources:
-    - '*'
+      - "*"
     verbs:
-    - '*'
+      - "*"
   - apiGroups:
-    - types.kubefed.io
+      - types.kubefed.io
     resources:
-    - '*'
+      - "*"
     verbs:
-    - '*'
\ No newline at end of file
+      - "*"
+  - apiGroups:
+      - monitoring.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - application.kubesphere.io
+    resources:
+      - "*"
+    verbs:
+      - "*"
diff --git a/src/main/ks-installer/templates/deployment.yaml b/src/main/ks-installer/templates/deployment.yaml
index eb09aeef..4dcc4beb 100644
--- a/src/main/ks-installer/templates/deployment.yaml
+++ b/src/main/ks-installer/templates/deployment.yaml
@@ -28,6 +28,7 @@ spec:
           volumeMounts:
             - mountPath: /etc/localtime
               name: host-time
+              readOnly: true
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/src/main/ks-installer/values.yaml b/src/main/ks-installer/values.yaml
index 31817c72..438ea8cc 100644
--- a/src/main/ks-installer/values.yaml
+++ b/src/main/ks-installer/values.yaml
@@ -9,7 +9,7 @@ image:
   repository: kubesphere/ks-installer
   pullPolicy: Always
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v3.2.1
+  tag: v3.3.0
 
 serviceAccount:
   # Specifies whether a service account should be created