diff --git a/kubernetes/dcaegen2/components/dcae-inventory-api/resources/config/config.json b/kubernetes/dcaegen2/components/dcae-inventory-api/resources/config/config.json
index d992731..4be8c19 100644
--- a/kubernetes/dcaegen2/components/dcae-inventory-api/resources/config/config.json
+++ b/kubernetes/dcaegen2/components/dcae-inventory-api/resources/config/config.json
@@ -1,8 +1,8 @@
 {
     "database": {
       "driverClass": "org.postgresql.Driver",
-      "user": "{{ .Values.postgres.config.pgUserName }}",
-      "password": "{{ .Values.postgres.config.pgUserPassword }}",
+      "user": "${PG_USER}",
+      "password": "${PG_PASSWORD}",
       "url": "jdbc:postgresql://{{ .Values.postgres.service.name2 }}:5432/{{ .Values.postgres.config.pgDatabase }}",
       "properties": {
         "charSet": "UTF-8"
diff --git a/kubernetes/dcaegen2/components/dcae-inventory-api/templates/deployment.yaml b/kubernetes/dcaegen2/components/dcae-inventory-api/templates/deployment.yaml
index 6769c00..bf49157 100644
--- a/kubernetes/dcaegen2/components/dcae-inventory-api/templates/deployment.yaml
+++ b/kubernetes/dcaegen2/components/dcae-inventory-api/templates/deployment.yaml
@@ -34,6 +34,25 @@
         release: {{ include "common.release" . }}
     spec:
       initContainers:
+        - command:
+          - sh
+          args:
+          - -c
+          - "cd /config-input && for PFILE in `find . -not -type d | grep -v -F ..`; do envsubst <${PFILE} >/config/${PFILE}; done"
+          env:
+          - name: PG_USER
+            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "pg-user-creds" "key" "login") | indent 12 }}
+          - name: PG_PASSWORD
+            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "pg-user-creds" "key" "password") | indent 12 }}
+          volumeMounts:
+          - mountPath: /config-input
+            name: {{ include "common.fullname" . }}-inv-config-input
+          - mountPath: /config
+            name: {{ include "common.fullname" . }}-inv-config
+          image: "{{ .Values.global.envsubstImage }}"
+          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+          name: {{ include "common.name" . }}-update-config
+
         - name: {{ include "common.name" . }}-readiness
           image: {{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}
           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
@@ -135,11 +154,13 @@
             defaultMode: 420
             name: {{ include "common.fullname" . }}-filebeat-configmap
           name: filebeat-conf
-        - name: {{ include "common.fullname" . }}-inv-config
+        - name: {{ include "common.fullname" . }}-inv-config-input
           configMap:
             name: {{ include "common.fullname" . }}-configmap
+        - name: {{ include "common.fullname" . }}-inv-config
+          emptyDir:
+            medium: Memory
         - emptyDir: {}
           name: tls-info
       imagePullSecrets:
       - name: "{{ include "common.namespace" . }}-docker-registry-key"
-
diff --git a/kubernetes/dcaegen2/components/dcae-inventory-api/templates/secret.yaml b/kubernetes/dcaegen2/components/dcae-inventory-api/templates/secret.yaml
new file mode 100644
index 0000000..b143034
--- /dev/null
+++ b/kubernetes/dcaegen2/components/dcae-inventory-api/templates/secret.yaml
@@ -0,0 +1,16 @@
+{{/*
+# Copyright © 2020 Samsung Electronics
+# #
+# # Licensed under the Apache License, Version 2.0 (the "License");
+# # you may not use this file except in compliance with the License.
+# # You may obtain a copy of the License at
+# #
+# #       http://www.apache.org/licenses/LICENSE-2.0
+# #
+# # Unless required by applicable law or agreed to in writing, software
+# # distributed under the License is distributed on an "AS IS" BASIS,
+# # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# # See the License for the specific language governing permissions and
+# # limitations under the License.
+*/}}
+{{ include "common.secretFast" . }}
diff --git a/kubernetes/dcaegen2/components/dcae-inventory-api/values.yaml b/kubernetes/dcaegen2/components/dcae-inventory-api/values.yaml
index 51af963..a26ae5d 100644
--- a/kubernetes/dcaegen2/components/dcae-inventory-api/values.yaml
+++ b/kubernetes/dcaegen2/components/dcae-inventory-api/values.yaml
@@ -26,10 +26,20 @@
   loggingImage: beats/filebeat:5.5.0
   tlsRepository: nexus3.onap.org:10001
   tlsImage: onap/org.onap.dcaegen2.deployments.tls-init-container:2.1.0
+  envsubstImage: dibi/envsubst
   repositoryCred:
     user: docker
     password: docker
 
+secrets:
+  - uid: pg-user-creds
+    name: &pgUserCredsSecretName '{{ include "common.release" . }}-dcae-inventory-api-pg-user-creds'
+    type: basicAuth
+    externalSecret: '{{ ternary "" (tpl (default "" .Values.postgres.config.pgUserExternalSecret) .) (hasSuffix "dcae-inventory-api-pg-user-creds" .Values.postgres.config.pgUserExternalSecret) }}'
+    login: '{{ .Values.postgres.config.pgUserName }}'
+    password: '{{ .Values.postgres.config.pgUserPassword }}'
+    passwordPolicy: generate
+
 config:
   logstashServiceName: log-ls
   logstashPort: 5044
@@ -82,24 +92,11 @@
       replica: dcae-inv-pg-replica
   config:
     pgUserName: dcae_inv
+    pgUserExternalSecret: *pgUserCredsSecretName
     pgDatabase: dcae_inventory
-    pgPrimaryPassword: onapdemodb
-    pgUserPassword: onapdemodb
-    pgRootPassword: onapdemodb
   persistence:
     mountSubPath: dcae-inv/data
     mountInitPath: dcae-inv
-  pgpool:
-    nameOverride: dcae-inv-pgpool
-    service:
-      name: dcae-inv-pgpool
-    credentials:
-      pgusername: ddcae_inv
-      pgpassword: onapdemodb
-    container:
-      name:
-        primary: dcae-inv-pgpool-primary
-        replica: dcae-inv-pgpool-replica
 
 # Resource Limit flavor -By Default using small
 flavor: small