diff --git a/docs/oom_cloud_setup_guide.rst b/docs/oom_cloud_setup_guide.rst
index 8431cf7..033ba43 100644
--- a/docs/oom_cloud_setup_guide.rst
+++ b/docs/oom_cloud_setup_guide.rst
@@ -46,9 +46,9 @@
 
 .. table:: OOM Software Requirements
 
-  ==============     ===========  =======  ========  ========
-  Release            Kubernetes   Helm     kubectl   Docker
-  ==============     ===========  =======  ========  ========
+  ==============     ===========  =======  ========  ======== ============
+  Release            Kubernetes   Helm     kubectl   Docker   Cert-Manager
+  ==============     ===========  =======  ========  ======== ============
   amsterdam          1.7.x        2.3.x    1.7.x     1.12.x
   beijing            1.8.10       2.8.2    1.8.10    17.03.x
   casablanca         1.11.5       2.9.1    1.11.5    17.03.x
@@ -57,7 +57,8 @@
   frankfurt          1.15.9       2.16.6   1.15.11   18.09.x
   guilin             1.15.11      2.16.10  1.15.11   18.09.x
   Honolulu           1.19.9       3.5.2    1.19.9    19.03.x
-  ==============     ===========  =======  ========  ========
+  Istanbul                                                    1.2.0
+  ==============     ===========  =======  ========  ======== ============
 
 .. note::
   Guilin version also supports Kubernetes up to version 1.19.x and should work
diff --git a/docs/oom_quickstart_guide.rst b/docs/oom_quickstart_guide.rst
index 2fedc09..d573c94 100644
--- a/docs/oom_quickstart_guide.rst
+++ b/docs/oom_quickstart_guide.rst
@@ -33,13 +33,19 @@
   > cp -R ~/oom/kubernetes/helm/plugins/ ~/.local/share/helm/plugins
   > helm plugin install https://github.com/chartmuseum/helm-push.git
 
-**Step 3** Install Chartmuseum::
+**Step 3.** Install Chartmuseum::
 
   > curl -LO https://s3.amazonaws.com/chartmuseum/release/latest/bin/linux/amd64/chartmuseum
   > chmod +x ./chartmuseum
   > mv ./chartmuseum /usr/local/bin
 
-**Step 4.** Customize the Helm charts like `oom/kubernetes/onap/values.yaml` or
+**Step 4.** Install Cert-Manager::
+
+  > kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.2.0/cert-manager.yaml
+
+More details can be found :doc:`here <oom_setup_paas>`.
+
+**Step 5.** Customize the Helm charts like `oom/kubernetes/onap/values.yaml` or
 an override file like `onap-all.yaml`, `onap-vfw.yaml` or `openstack.yaml` file
 to suit your deployment with items like the OpenStack tenant information.
 
@@ -67,12 +73,6 @@
 
 
 
-.. note::
-  If you want to use CMPv2 certificate onboarding, Cert-Manager must be installed.
-  :doc:`Click here <oom_setup_paas>` to see how to install Cert-Manager.
-
-
-
 a. Enabling/Disabling Components:
 Here is an example of the nominal entries that need to be provided.
 We have different values file available for different contexts.
@@ -154,7 +154,7 @@
    :language: yaml
 
 
-**Step 5.** To setup a local Helm server to server up the ONAP charts::
+**Step 6.** To setup a local Helm server to server up the ONAP charts::
 
   > chartmuseum --storage local --storage-local-rootdir ~/helm3-storage -port 8879 &
 
@@ -163,13 +163,13 @@
 
   > helm repo add local http://127.0.0.1:8879
 
-**Step 6.** Verify your Helm repository setup with::
+**Step 7.** Verify your Helm repository setup with::
 
   > helm repo list
   NAME   URL
   local  http://127.0.0.1:8879
 
-**Step 7.** Build a local Helm repository (from the kubernetes directory)::
+**Step 8.** Build a local Helm repository (from the kubernetes directory)::
 
   > make SKIP_LINT=TRUE [HELM_BIN=<HELM_PATH>] all ; make SKIP_LINT=TRUE [HELM_BIN=<HELM_PATH>] onap
 
@@ -177,7 +177,7 @@
   Sets the helm binary to be used. The default value use helm from PATH
 
 
-**Step 8.** Display the onap charts that available to be deployed::
+**Step 9.** Display the onap charts that available to be deployed::
 
   > helm repo update
   > helm search repo onap
@@ -189,7 +189,7 @@
   to your deployment charts or values be sure to use ``make`` to update your
   local Helm repository.
 
-**Step 9.** Once the repo is setup, installation of ONAP can be done with a
+**Step 10.** Once the repo is setup, installation of ONAP can be done with a
 single command
 
 .. note::
@@ -237,7 +237,7 @@
   you want to use to deploy VNFs from ONAP and/or additional parameters for the
   embedded tests.
 
-**Step 10.** Verify ONAP installation
+**Step 11.** Verify ONAP installation
 
 Use the following to monitor your deployment and determine when ONAP is ready
 for use::
@@ -251,7 +251,7 @@
 
     > ~/oom/kubernetes/robot/ete-k8s.sh onap health
 
-**Step 11.** Undeploy ONAP
+**Step 12.** Undeploy ONAP
 ::
 
   > helm undeploy dev
diff --git a/docs/oom_setup_paas.rst b/docs/oom_setup_paas.rst
index 258a4ee..845fd47 100644
--- a/docs/oom_setup_paas.rst
+++ b/docs/oom_setup_paas.rst
@@ -9,11 +9,11 @@
 
 .. _oom_setup_paas:
 
-ONAP PaaS set-up (optional)
-###########################
+ONAP PaaS set-up
+################
 
 Starting from Honolulu release, Cert-Manager and Prometheus Stack are a part
-of k8s PaaS for ONAP operations and can be optionally installed to provide
+of k8s PaaS for ONAP operations and can be installed to provide
 additional functionality for ONAP engineers.
 
 The versions of PaaS compoents that are supported by OOM are as follows:
@@ -63,8 +63,8 @@
 
   > kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.2.0/cert-manager.yaml
 
-Prometheus Stack
-================
+Prometheus Stack (optional)
+===========================
 
 Prometheus is an open-source systems monitoring and alerting toolkit with
 an active ecosystem.
diff --git a/docs/oom_user_guide.rst b/docs/oom_user_guide.rst
index 02f5c48..3a707e2 100644
--- a/docs/oom_user_guide.rst
+++ b/docs/oom_user_guide.rst
@@ -55,8 +55,8 @@
 
 Pre-requisites
 --------------
-Your environment must have both the Kubernetes `kubectl` and Helm setup as a
-one time activity.
+Your environment must have the Kubernetes `kubectl` with Cert-Manager
+and Helm setup as a one time activity.
 
 Install Kubectl
 ~~~~~~~~~~~~~~~
@@ -78,6 +78,11 @@
 
 At this point you should see Kubernetes pods running.
 
+Install Cert-Manager
+~~~~~~~~~~~~~~~~~~~~
+Details on how to install Cert-Manager can be found
+:doc:`here <oom_setup_paas>`.
+
 Install Helm
 ~~~~~~~~~~~~
 Helm is used by OOM for package and configuration management. To install Helm,
diff --git a/kubernetes/aaf/components/aaf-cass/resources/cass-init-dats/perm.dat b/kubernetes/aaf/components/aaf-cass/resources/cass-init-dats/perm.dat
index df2e128..d29617a 100644
--- a/kubernetes/aaf/components/aaf-cass/resources/cass-init-dats/perm.dat
+++ b/kubernetes/aaf/components/aaf-cass/resources/cass-init-dats/perm.dat
@@ -49,6 +49,7 @@
 org.onap.clamp|clds.template|dev|read|Onap Clamp Dev Read Access|"{'org.onap.clamp.clds.designer.dev', 'org.onap.clamp|clds.admin.dev'}"
 org.onap.clamp|clds.template|dev|update|Onap Clamp Dev Update Access|"{'org.onap.clamp.clds.designer.dev', 'org.onap.clamp|clds.admin.dev'}"
 org.onap.clamp|clds.tosca|dev|*||"{'org.onap.clamp|service'}"
+org.onap.clamp|clds.policies|dev|*||"{'org.onap.clamp|service'}"
 org.onap.clampdemo|access|*|*|ClampDemo Write Access|{'org.onap.clampdemo.admin'}
 org.onap.clampdemo|access|*|read|ClampDemo Read Access|{'org.onap.clampdemo.owner'}
 org.onap.clamptest|access|*|*|Onap Write Access|{'org.onap.clamptest.admin'}
diff --git a/kubernetes/aaf/components/aaf-cass/resources/cass-init-dats/role.dat b/kubernetes/aaf/components/aaf-cass/resources/cass-init-dats/role.dat
index ea15da4..d73a09d 100644
--- a/kubernetes/aaf/components/aaf-cass/resources/cass-init-dats/role.dat
+++ b/kubernetes/aaf/components/aaf-cass/resources/cass-init-dats/role.dat
@@ -40,7 +40,7 @@
 org.onap.clampdemo|owner|onap clamp Test Owners|"{'org.onap.clampdemo.access|*|read'}"
 org.onap.clamp|owner|AAF Namespace Owners|
 org.onap.clamp|seeCerts||"{'org.onap.clamp|certman|local|request,ignoreIPs,showpass'}"
-org.onap.clamp|service||"{'org.onap.clamp|access|*|*', 'org.onap.clamp|clds.cl.manage|dev|*', 'org.onap.clamp|clds.cl|dev|*', 'org.onap.clamp|clds.filter.vf|dev|*', 'org.onap.clamp|clds.template|dev|*', 'org.onap.clamp|clds.tosca|dev|*'}"
+org.onap.clamp|service||"{'org.onap.clamp|access|*|*', 'org.onap.clamp|clds.cl.manage|dev|*', 'org.onap.clamp|clds.cl|dev|*', 'org.onap.clamp|clds.filter.vf|dev|*', 'org.onap.clamp|clds.template|dev|*', 'org.onap.clamp|clds.tosca|dev|*', 'org.onap.clamp|clds.policies|dev|*'}"
 org.onap.clamptest|admin|Onap Clamp Test  Admins|"{'org.onap.clamptest.access|*|*'}"
 org.onap.clamptest|owner|onap clamp Test Owners|"{'org.onap.clamptest.access|*|read'}"
 org.onap.cli|admin|AAF Namespace Administrators|"{'org.onap.cli|access|*|*'}"
diff --git a/kubernetes/appc/components/appc-cdt/values.yaml b/kubernetes/appc/components/appc-cdt/values.yaml
index 3b1ff47..5765d34 100644
--- a/kubernetes/appc/components/appc-cdt/values.yaml
+++ b/kubernetes/appc/components/appc-cdt/values.yaml
@@ -38,27 +38,17 @@
   cadi_longitude: "-72.0"
   credsPath: /opt/app/osaaf/local
   aaf_add_config: |
-    echo "*** retrieving password for keystore"
-    export $(/opt/app/aaf_config/bin/agent.sh local showpass \
-      {{.Values.fqi}} {{ .Values.fqdn }} | grep '^c' | xargs -0)
-    if [ -z "$cadi_keystore_password_p12" ]
-    then
-      echo "  /!\ certificates retrieval failed"
-      exit 1
-    else
-      cd {{ .Values.credsPath }};
-      mkdir -p certs;
-      echo "*** transform AAF certs into pem files"
-      mkdir -p {{ .Values.credsPath }}/certs
-      openssl pkcs12 -in {{ .Values.credsPath }}/{{ .Values.fqi_namespace }}.p12 \
-        -nokeys -out {{ .Values.credsPath }}/certs/cert.pem \
-        -passin pass:$cadi_keystore_password_p12 \
-        -passout pass:$cadi_keystore_password_p12
-      echo "*** copy key file"
-      cp {{ .Values.fqi_namespace }}.key certs/key.pem;
-      echo "*** change ownership of certificates to targeted user"
-      chown -R 1000 {{ .Values.credsPath }}
-    fi
+    echo "*** transform AAF certs into pem files"
+    mkdir -p {{ .Values.credsPath }}/certs
+    openssl pkcs12 -in {{ .Values.credsPath }}/{{ .Values.fqi_namespace }}.p12 \
+      -nokeys -out {{ .Values.credsPath }}/certs/cert.pem \
+      -passin pass:$cadi_keystore_password_p12 \
+      -passout pass:$cadi_keystore_password_p12
+    echo "*** copy key file"
+    cp {{ .Values.credsPath }}/{{ .Values.fqi_namespace }}.key \
+      {{ .Values.credsPath }}/certs/key.pem
+    echo "*** change ownership of certificates to targeted user"
+    chown -R 1000 {{ .Values.credsPath }}
 
 #################################################################
 # Application configuration defaults.
diff --git a/kubernetes/appc/resources/config/appc/opt/onap/appc/bin/startODL.sh b/kubernetes/appc/resources/config/appc/opt/onap/appc/bin/startODL.sh
index 2fd6db1..85f5aac 100755
--- a/kubernetes/appc/resources/config/appc/opt/onap/appc/bin/startODL.sh
+++ b/kubernetes/appc/resources/config/appc/opt/onap/appc/bin/startODL.sh
@@ -65,7 +65,7 @@
 # Wait for database to init properly
 #
 echo "Waiting for mariadbgalera"
-until mysql -h {{.Values.config.mariadbGaleraSVCName}}.{{.Release.Namespace}} -u root -p${MYSQL_PASSWD}  mysql &> /dev/null
+until mysql -h {{.Values.config.mariadbGaleraSVCName}}.{{.Release.Namespace}} -u root -p${MYSQL_PASSWD}  mysql >/dev/null 2>&1
 do
   printf "."
   sleep 1
diff --git a/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh b/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh
index ec1ce94..cb4153e 100755
--- a/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh
+++ b/kubernetes/common/cert-wrapper/resources/import-custom-certs.sh
@@ -58,7 +58,8 @@
 # Prepare truststore output file
 if [ "$AAF_ENABLED" = "true" ]
   then
-    mv $WORK_DIR/$ONAP_TRUSTSTORE $WORK_DIR/$TRUSTSTORE_OUTPUT_FILENAME
+    echo "AAF is enabled, use 'AAF' truststore"
+    export TRUSTSTORE_OUTPUT_FILENAME=${ONAP_TRUSTSTORE}
   else
     echo "AAF is disabled, using JRE truststore"
     cp $JRE_TRUSTSTORE $WORK_DIR/$TRUSTSTORE_OUTPUT_FILENAME
diff --git a/kubernetes/common/certManagerCertificate/templates/_certificate.tpl b/kubernetes/common/certManagerCertificate/templates/_certificate.tpl
index 108873b..2b9461e 100644
--- a/kubernetes/common/certManagerCertificate/templates/_certificate.tpl
+++ b/kubernetes/common/certManagerCertificate/templates/_certificate.tpl
@@ -189,6 +189,8 @@
 {{ end }}
 {{- end -}}
 
+{{/*Using templates below allows read and write access to volume mounted at $mountPath*/}}
+
 {{- define "common.certManager.volumeMounts" -}}
 {{- $dot := default . .dot -}}
 {{- $initRoot := default $dot.Values.certManagerCertificate .initRoot -}}
@@ -217,8 +219,14 @@
     sources:
     - secret:
         name: {{ $certificatesSecretName }}
-    {{- if $certificate.keystore }}
         items:
+          - key: tls.key
+            path: key.pem
+          - key: tls.crt
+            path: cert.pem
+          - key: ca.crt
+            path: cacert.pem
+    {{- if $certificate.keystore }}
         {{- range $outputType := $certificate.keystore.outputType }}
           - key: keystore.{{ $outputType }}
             path: keystore.{{ $outputType }}
@@ -248,4 +256,55 @@
     {{- $certsLinkCommand = (printf "ln -s %s %s; %s" $sourcePath $destnationPath $certsLinkCommand) -}}
   {{- end -}}
 {{ $certsLinkCommand }}
-{{- end -}}
\ No newline at end of file
+{{- end -}}
+
+{{/*Using templates below allows only read access to volume mounted at $mountPath*/}}
+
+{{- define "common.certManager.volumeMountsReadOnly" -}}
+{{- $dot := default . .dot -}}
+{{- $initRoot := default $dot.Values.certManagerCertificate .initRoot -}}
+{{- $subchartGlobal := mergeOverwrite (deepCopy $initRoot.global) $dot.Values.global -}}
+  {{- range $i, $certificate := $dot.Values.certificates -}}
+    {{- $mountPath := $certificate.mountPath -}}
+- mountPath: {{ $mountPath }}
+  name: certmanager-certs-volume-{{ $i }}
+   {{- end -}}
+{{- end -}}
+
+{{- define "common.certManager.volumesReadOnly" -}}
+{{- $dot := default . .dot -}}
+{{- $initRoot := default $dot.Values.certManagerCertificate .initRoot -}}
+{{- $subchartGlobal := mergeOverwrite (deepCopy $initRoot.global) $dot.Values.global -}}
+{{- $certificates := $dot.Values.certificates -}}
+  {{- range $i, $certificate := $certificates -}}
+    {{- $name := include "common.fullname" $dot -}}
+    {{- $certificatesSecretName := default (printf "%s-secret-%d" $name $i) $certificate.secretName -}}
+- name: certmanager-certs-volume-{{ $i }}
+  projected:
+    sources:
+    - secret:
+        name: {{ $certificatesSecretName }}
+        items:
+          - key: tls.key
+            path: key.pem
+          - key: tls.crt
+            path: cert.pem
+          - key: ca.crt
+            path: cacert.pem
+    {{- if $certificate.keystore }}
+        {{- range $outputType := $certificate.keystore.outputType }}
+          - key: keystore.{{ $outputType }}
+            path: keystore.{{ $outputType }}
+          - key: truststore.{{ $outputType }}
+            path: truststore.{{ $outputType }}
+        {{- end }}
+    - secret:
+        name: {{ $certificate.keystore.passwordSecretRef.name }}
+        items:
+          - key: {{ $certificate.keystore.passwordSecretRef.key }}
+            path: keystore.pass
+          - key: {{ $certificate.keystore.passwordSecretRef.key }}
+            path: truststore.pass
+     {{- end }}
+  {{- end -}}
+{{- end -}}
diff --git a/kubernetes/contrib/components/ejbca/values.yaml b/kubernetes/contrib/components/ejbca/values.yaml
index 69d993e..57d1e78 100644
--- a/kubernetes/contrib/components/ejbca/values.yaml
+++ b/kubernetes/contrib/components/ejbca/values.yaml
@@ -54,7 +54,7 @@
 replicaCount: 1
 
 ejbca:
-  image: primekey/ejbca-ce:6.15.2.5
+  image: primekey/ejbca-ce:7.4.3.2
 pullPolicy: Always
 
 mariadb-galera:
diff --git a/kubernetes/dcaegen2-services/common/dcaegen2-services-common/templates/_deployment.tpl b/kubernetes/dcaegen2-services/common/dcaegen2-services-common/templates/_deployment.tpl
index 9c9cc70..10a63eb 100644
--- a/kubernetes/dcaegen2-services/common/dcaegen2-services-common/templates/_deployment.tpl
+++ b/kubernetes/dcaegen2-services/common/dcaegen2-services-common/templates/_deployment.tpl
@@ -3,6 +3,7 @@
 # ================================================================================
 # Copyright (c) 2021 J. F. Lucas. All rights reserved.
 # Copyright (c) 2021 AT&T Intellectual Property. All rights reserved.
+# Copyright (c) 2021 Nokia. All rights reserved.
 # ================================================================================
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -190,6 +191,7 @@
         - mountPath: /opt/app/osaaf
           name: tls-info
       {{- end }}
+      {{ include "dcaegen2-services-common._certPostProcessor" .  | nindent 4 }}
       containers:
       - image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }}
         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
@@ -197,7 +199,7 @@
         env:
         {{- if $certDir }}
         - name: DCAE_CA_CERTPATH
-          value: {{ $certDir}}/cacert.pem
+          value: {{ $certDir }}/cacert.pem
         {{- end }}
         - name: CONSUL_HOST
           value: consul-server.onap
@@ -245,6 +247,9 @@
         {{- if $certDir }}
         - mountPath: {{ $certDir }}
           name: tls-info
+          {{- if and .Values.certificates .Values.global.cmpv2Enabled .Values.global.CMPv2CertManagerIntegration -}}
+          {{- include "common.certManager.volumeMountsReadOnly" . | nindent 8 -}}
+          {{- end -}}
         {{- end }}
         {{- if $policy }}
         - name: policy-shared
@@ -291,7 +296,7 @@
               name: onap-policy-xacml-pdp-api-creds
               key: password
         - name: POLICY_SYNC_PDP_URL
-          value : http{{ if (include "common.needTLS" .) }}s{{ end }}://policy-xacml-pdp:6969 
+          value : http{{ if (include "common.needTLS" .) }}s{{ end }}://policy-xacml-pdp:6969
         - name: POLICY_SYNC_OUTFILE
           value : "/etc/policies/policies.json"
         - name: POLICY_SYNC_V1_DECISION_ENDPOINT
@@ -339,6 +344,9 @@
       {{- if $certDir }}
       - emptyDir: {}
         name: tls-info
+        {{ if and .Values.certificates .Values.global.cmpv2Enabled .Values.global.CMPv2CertManagerIntegration -}}
+        {{ include "common.certManager.volumesReadOnly" . | nindent 6 }}
+        {{- end }}
       {{- end }}
       {{- if $policy }}
       - name: policy-shared
@@ -347,3 +355,49 @@
       imagePullSecrets:
       - name: "{{ include "common.namespace" . }}-docker-registry-key"
 {{ end -}}
+
+{{/*
+  For internal use
+
+  Template to attach CertPostProcessor which merges CMPv2 truststore with AAF truststore
+  and swaps keystore files.
+*/}}
+{{- define "dcaegen2-services-common._certPostProcessor" -}}
+  {{- $certDir := default "" .Values.certDirectory . -}}
+  {{- if and $certDir .Values.certificates .Values.global.cmpv2Enabled .Values.global.CMPv2CertManagerIntegration -}}
+    {{- $cmpv2Certificate := (index .Values.certificates 0) -}}
+    {{- $cmpv2CertificateDir := $cmpv2Certificate.mountPath -}}
+    {{- $certType := "pem" -}}
+    {{- if $cmpv2Certificate.keystore -}}
+      {{- $certType = (index $cmpv2Certificate.keystore.outputType 0) -}}
+    {{- end -}}
+    {{- $truststoresPaths := printf "%s/%s:%s/%s" $certDir "cacert.pem" $cmpv2CertificateDir "cacert.pem" -}}
+    {{- $truststoresPasswordPaths := ":" -}}
+    {{- $keystoreSourcePaths := printf "%s/%s:%s/%s" $cmpv2CertificateDir "cert.pem" $cmpv2CertificateDir "key.pem" -}}
+    {{- $keystoreDestinationPaths := printf "%s/%s:%s/%s" $certDir "cert.pem" $certDir "key.pem" -}}
+    {{- if not (eq $certType "pem") -}}
+      {{- $truststoresPaths = printf "%s/%s:%s/%s.%s" $certDir "trust.jks" $cmpv2CertificateDir "truststore" $certType -}}
+      {{- $truststoresPasswordPaths = printf "%s/%s:%s/%s" $certDir "trust.pass" $cmpv2CertificateDir "truststore.pass" -}}
+      {{- $keystoreSourcePaths = printf "%s/%s.%s:%s/%s" $cmpv2CertificateDir "keystore" $certType $cmpv2CertificateDir "keystore.pass" -}}
+      {{- $keystoreDestinationPaths = printf "%s/%s.%s:%s/%s.pass" $certDir "cert" $certType $certDir $certType -}}
+    {{- end }}
+  - name: cert-post-processor
+    image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.certPostProcessorImage }}
+    imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+    resources:
+      {{- include "common.resources" . | nindent 4 }}
+    volumeMounts:
+    - mountPath: {{ $certDir }}
+      name: tls-info
+      {{- include "common.certManager.volumeMountsReadOnly" . | nindent 4 }}
+    env:
+    - name: TRUSTSTORES_PATHS
+      value: {{ $truststoresPaths | quote}}
+    - name: TRUSTSTORES_PASSWORDS_PATHS
+      value: {{ $truststoresPasswordPaths | quote }}
+    - name: KEYSTORE_SOURCE_PATHS
+      value: {{ $keystoreSourcePaths | quote }}
+    - name: KEYSTORE_DESTINATION_PATHS
+      value: {{ $keystoreDestinationPaths | quote }}
+  {{- end }}
+{{- end -}}
diff --git a/kubernetes/dcaegen2-services/common/dcaegen2-services-common/values.yaml b/kubernetes/dcaegen2-services/common/dcaegen2-services-common/values.yaml
index cd69da8..cbd07dc 100644
--- a/kubernetes/dcaegen2-services/common/dcaegen2-services-common/values.yaml
+++ b/kubernetes/dcaegen2-services/common/dcaegen2-services-common/values.yaml
@@ -15,4 +15,4 @@
 # limitations under the License.
 # ============LICENSE_END=========================================================
 # dcaegen2-services-common templates get any values from the scope
-# they are passed.  There are no locally-defined values.
\ No newline at end of file
+# they are passed.  There are no locally-defined values.
diff --git a/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/requirements.yaml b/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/requirements.yaml
index 639fc2c..929cdbb 100644
--- a/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/requirements.yaml
+++ b/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/requirements.yaml
@@ -1,4 +1,5 @@
 # Copyright (c) 2021 J. F. Lucas.  All rights reserved.
+# Copyright (c) 2021 Nokia.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -25,3 +26,6 @@
   - name: dcaegen2-services-common
     version: ~8.x-0
     repository: 'file://../../common/dcaegen2-services-common'
+  - name: certManagerCertificate
+    version: ~8.x-0
+    repository: '@local'
diff --git a/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/templates/certificates.yaml b/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/templates/certificates.yaml
new file mode 100644
index 0000000..0db2138
--- /dev/null
+++ b/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/templates/certificates.yaml
@@ -0,0 +1,19 @@
+{{/*
+# Copyright © 2021 Nokia
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+
+{{ if and .Values.certDirectory .Values.global.cmpv2Enabled .Values.global.CMPv2CertManagerIntegration }}
+{{ include "certManagerCertificate.certificate" . }}
+{{ end }}
diff --git a/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/values.yaml b/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/values.yaml
index cec3322..bb65f37 100644
--- a/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/values.yaml
+++ b/kubernetes/dcaegen2-services/components/dcae-hv-ves-collector/values.yaml
@@ -1,6 +1,7 @@
 #============LICENSE_START========================================================
 # ================================================================================
 # Copyright (c) 2021 J. F. Lucas. All rights reserved.
+# Copyright (c) 2021 Nokia.  All rights reserved.
 # ================================================================================
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -34,6 +35,7 @@
 #################################################################
 tlsImage: onap/org.onap.dcaegen2.deployments.tls-init-container:2.1.0
 consulLoaderImage: onap/org.onap.dcaegen2.deployments.consul-loader-container:1.1.0
+certPostProcessorImage: onap/org.onap.oom.platform.cert-service.oom-certservice-post-processor:2.3.3
 
 #################################################################
 # Application configuration defaults.
@@ -62,6 +64,24 @@
     password: '{{ .Values.aafCreds.password }}'
     passwordPolicy: required
 
+# CMPv2 certificate
+# It is used only when global parameter cmpv2Enabled is true
+# Disabled by default
+certificates:
+  - mountPath: /etc/ves-hv/ssl/external
+    commonName: dcae-hv-ves-collector
+    dnsNames:
+      - dcae-hv-ves-collector
+      - hv-ves-collector
+      - hv-ves
+    keystore:
+      outputType:
+        - jks
+      passwordSecretRef:
+        name: hv-ves-cmpv2-keystore-password
+        key: password
+        create: true
+
 # dependencies
 readinessCheck:
   wait_for:
diff --git a/kubernetes/dcaegen2-services/components/dcae-ves-collector/requirements.yaml b/kubernetes/dcaegen2-services/components/dcae-ves-collector/requirements.yaml
index 639fc2c..929cdbb 100644
--- a/kubernetes/dcaegen2-services/components/dcae-ves-collector/requirements.yaml
+++ b/kubernetes/dcaegen2-services/components/dcae-ves-collector/requirements.yaml
@@ -1,4 +1,5 @@
 # Copyright (c) 2021 J. F. Lucas.  All rights reserved.
+# Copyright (c) 2021 Nokia.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -25,3 +26,6 @@
   - name: dcaegen2-services-common
     version: ~8.x-0
     repository: 'file://../../common/dcaegen2-services-common'
+  - name: certManagerCertificate
+    version: ~8.x-0
+    repository: '@local'
diff --git a/kubernetes/dcaegen2-services/components/dcae-ves-collector/templates/certificates.yaml b/kubernetes/dcaegen2-services/components/dcae-ves-collector/templates/certificates.yaml
new file mode 100644
index 0000000..0db2138
--- /dev/null
+++ b/kubernetes/dcaegen2-services/components/dcae-ves-collector/templates/certificates.yaml
@@ -0,0 +1,19 @@
+{{/*
+# Copyright © 2021 Nokia
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+
+{{ if and .Values.certDirectory .Values.global.cmpv2Enabled .Values.global.CMPv2CertManagerIntegration }}
+{{ include "certManagerCertificate.certificate" . }}
+{{ end }}
diff --git a/kubernetes/dcaegen2-services/components/dcae-ves-collector/values.yaml b/kubernetes/dcaegen2-services/components/dcae-ves-collector/values.yaml
index 62c6404..081bcdc 100644
--- a/kubernetes/dcaegen2-services/components/dcae-ves-collector/values.yaml
+++ b/kubernetes/dcaegen2-services/components/dcae-ves-collector/values.yaml
@@ -1,6 +1,7 @@
 #============LICENSE_START========================================================
 # ================================================================================
 # Copyright (c) 2021 J. F. Lucas. All rights reserved.
+# Copyright (c) 2021 Nokia.  All rights reserved.
 # ================================================================================
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -34,6 +35,7 @@
 #################################################################
 tlsImage: onap/org.onap.dcaegen2.deployments.tls-init-container:2.1.0
 consulLoaderImage: onap/org.onap.dcaegen2.deployments.consul-loader-container:1.1.0
+certPostProcessorImage: onap/org.onap.oom.platform.cert-service.oom-certservice-post-processor:2.3.3
 
 #################################################################
 # Application configuration defaults.
@@ -55,6 +57,24 @@
 # and key from AAF and mount them in certDirectory.
 tlsServer: true
 
+# CMPv2 certificate
+# It is used only when global parameter cmpv2Enabled is true
+# Disabled by default
+certificates:
+  - mountPath: /opt/app/dcae-certificate/external
+    commonName: dcae-ves-collector
+    dnsNames:
+      - dcae-ves-collector
+      - ves-collector
+      - ves
+    keystore:
+      outputType:
+        - jks
+      passwordSecretRef:
+        name: ves-cmpv2-keystore-password
+        key: password
+        create: true
+
 # dependencies
 readinessCheck:
   wait_for:
diff --git a/kubernetes/helm/plugins/deploy/deploy.sh b/kubernetes/helm/plugins/deploy/deploy.sh
index a7e394d..44e8e56 100755
--- a/kubernetes/helm/plugins/deploy/deploy.sh
+++ b/kubernetes/helm/plugins/deploy/deploy.sh
@@ -54,7 +54,7 @@
       cat $COMPUTED_OVERRIDES | sed '/common:/,/consul:/d' \
         | sed -n '/^'"$START"'/,/'log:'/p' | sed '1d;$d' >> $GLOBAL_OVERRIDES
     else
-      SUBCHART_DIR="$CACHE_SUBCHART_DIR/$(cut -d':' -f1 <<<"$START")"
+      SUBCHART_DIR="$CACHE_SUBCHART_DIR/$(echo "$START" |cut -d':' -f1)"
       if [[ -d "$SUBCHART_DIR" ]]; then
         if [[ -z "$END" ]]; then
           cat $COMPUTED_OVERRIDES | sed -n '/^'"$START"'/,/'"$END"'/p' \
@@ -96,8 +96,8 @@
   RELEASE=$1
   CHART_URL=$2
   FLAGS=${@:3}
-  CHART_REPO="$(cut -d'/' -f1 <<<"$CHART_URL")"
-  CHART_NAME="$(cut -d'/' -f2 <<<"$CHART_URL")"
+  CHART_REPO="$(echo "$CHART_URL" |cut -d'/' -f1)"
+  CHART_NAME="$(echo "$CHART_URL" |cut -d'/' -f2)"
   if [[ $HELM_VER = "v3."* ]]; then
     CACHE_DIR=~/.local/share/helm/plugins/deploy/cache
   else
@@ -146,9 +146,9 @@
   DEPLOY_FLAGS=$(resolve_deploy_flags "$FLAGS")
 
   # determine if upgrading individual subchart or entire parent + subcharts
-  SUBCHART_RELEASE="$(cut -d'-' -f2 <<<"$RELEASE")"
+  SUBCHART_RELEASE="$(echo "$RELEASE" |cut -d'-' -f2)"
   # update specified subchart without parent
-  RELEASE="$(cut -d'-' -f1 <<<"$RELEASE")"
+  RELEASE="$(echo "$RELEASE" |cut -d'-' -f1)"
   if [[ $SUBCHART_RELEASE = $RELEASE ]]; then
     SUBCHART_RELEASE=
   fi
diff --git a/kubernetes/platform/components/cmpv2-cert-provider/values.yaml b/kubernetes/platform/components/cmpv2-cert-provider/values.yaml
index c34ebad..fd34b1e 100644
--- a/kubernetes/platform/components/cmpv2-cert-provider/values.yaml
+++ b/kubernetes/platform/components/cmpv2-cert-provider/values.yaml
@@ -73,7 +73,7 @@
   certEndpoint: v1/certificate
   caName: RA
   certSecretRef:
-    name: oom-cert-service-server-tls-secret
+    name: oom-cert-service-client-tls-secret
     certRef: tls.crt
     keyRef: tls.key
     cacertRef: ca.crt
diff --git a/kubernetes/platform/components/oom-cert-service/templates/fake_deployment.yaml b/kubernetes/platform/components/oom-cert-service/templates/fake_deployment.yaml
deleted file mode 100644
index ba12874..0000000
--- a/kubernetes/platform/components/oom-cert-service/templates/fake_deployment.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-{{/*
-  # Copyright © 2020, Nokia
-  #
-  # Licensed under the Apache License, Version 2.0 (the "License");
-  # you may not use this file except in compliance with the License.
-  # You may obtain a copy of the License at
-  #
-  #       http://www.apache.org/licenses/LICENSE-2.0
-  #
-  # Unless required by applicable law or agreed to in writing, software
-  # distributed under the License is distributed on an "AS IS" BASIS,
-  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  # See the License for the specific language governing permissions and
-  # limitations under the License.
-*/}}
-
-{{- if .Values.global.offlineDeploymentBuild }}
-apiVersion: apps/v1
-kind: Deployment
-metadata: {{- include "common.resourceMetadata" . | nindent 2 }}
-spec:
-  replicas: {{ .Values.replicaCount }}
-  selector: {{- include "common.selectors" . | nindent 4 }}
-  template:
-    metadata: {{- include "common.templateMetadata" . | nindent 6 }}
-    spec:
-      containers:
-        - name: {{ include "common.name" . }}
-          image: {{ include "common.repository" . }}/{{ .Values.certificateGenerationImage }}
-          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
-{{ end -}}
diff --git a/kubernetes/platform/components/oom-cert-service/values.yaml b/kubernetes/platform/components/oom-cert-service/values.yaml
index 829d3a0..2e14968 100644
--- a/kubernetes/platform/components/oom-cert-service/values.yaml
+++ b/kubernetes/platform/components/oom-cert-service/values.yaml
@@ -22,7 +22,6 @@
   # Standard OOM
   pullPolicy: "Always"
   repository: "nexus3.onap.org:10001"
-  offlineDeploymentBuild: false
 
 
 # Service configuration
@@ -33,9 +32,6 @@
       port: 8443
       port_protocol: http
 
-# Certificates generation configuration
-certificateGenerationImage: onap/integration-java11:7.2.0
-
 # Deployment configuration
 repository: "nexus3.onap.org:10001"
 image: onap/org.onap.oom.platform.cert-service.oom-certservice-api:2.3.3
diff --git a/kubernetes/policy/components/policy-clamp-be/resources/config/application.properties b/kubernetes/policy/components/policy-clamp-be/resources/config/application.properties
index 17185cc..a633466 100644
--- a/kubernetes/policy/components/policy-clamp-be/resources/config/application.properties
+++ b/kubernetes/policy/components/policy-clamp-be/resources/config/application.properties
@@ -48,22 +48,22 @@
 spring.profiles.active=clamp-default,clamp-aaf-authentication,clamp-sdc-controller,clamp-ssl-config,clamp-policy-controller,default-dictionary-elements
 
 #The log folder that will be used in logback.xml file
-clamp.config.files.sdcController=file:/opt/policy/clamp/sdc-controllers-config.json
+clamp.config.files.sdcController=file:/opt/policy/clamp/sdc-controllers-config-pass.json
 
 #
 # Configuration Settings for Policy Engine Components
-clamp.config.policy.api.url=https4://policy-api.{{ include "common.namespace" . }}:6969
+clamp.config.policy.api.url=https://policy-api.{{ include "common.namespace" . }}:6969
 clamp.config.policy.api.userName=healthcheck
 clamp.config.policy.api.password=zb!XztG34
-clamp.config.policy.pap.url=https4://policy-pap.{{ include "common.namespace" . }}:6969
+clamp.config.policy.pap.url=https://policy-pap.{{ include "common.namespace" . }}:6969
 clamp.config.policy.pap.userName=healthcheck
 clamp.config.policy.pap.password=zb!XztG34
 
 #DCAE Inventory Url Properties
-clamp.config.dcae.inventory.url=https4://inventory.{{ include "common.namespace" . }}:8080
-clamp.config.dcae.dispatcher.url=https4://deployment-handler.{{ include "common.namespace" . }}:8443
+clamp.config.dcae.inventory.url=https://inventory.{{ include "common.namespace" . }}:8080
+clamp.config.dcae.dispatcher.url=https://deployment-handler.{{ include "common.namespace" . }}:8443
 #DCAE Deployment Url Properties
-clamp.config.dcae.deployment.url=https4://deployment-handler.{{ include "common.namespace" . }}:8443
+clamp.config.dcae.deployment.url=https://deployment-handler.{{ include "common.namespace" . }}:8443
 clamp.config.dcae.deployment.userName=none
 clamp.config.dcae.deployment.password=none
 
diff --git a/kubernetes/policy/components/policy-clamp-be/resources/config/sdc-controllers-config.json b/kubernetes/policy/components/policy-clamp-be/resources/config/sdc-controllers-config.json
index 3adda95..6021b21 100644
--- a/kubernetes/policy/components/policy-clamp-be/resources/config/sdc-controllers-config.json
+++ b/kubernetes/policy/components/policy-clamp-be/resources/config/sdc-controllers-config.json
@@ -6,7 +6,7 @@
         "consumerId": "clamp",
         "environmentName": "AUTO",
         "sdcAddress": "sdc-be.{{ include "common.namespace" . }}:8443",
-        "password": "b7acccda32b98c5bb7acccda32b98c5b05D511BD6D93626E90D18E9D24D9B78CD34C7EE8012F0A189A28763E82271E50A5D4EC10C7D93E06E0A2D27CAE66B981",
+        "password": "${SDC_CLIENT_PASSWORD_ENC}",
         "pollingInterval":30,
         "pollingTimeout":30,
         "activateServerTLSAuth":"false",
diff --git a/kubernetes/policy/components/policy-clamp-be/templates/deployment.yaml b/kubernetes/policy/components/policy-clamp-be/templates/deployment.yaml
index 1120f9b..c243e30 100644
--- a/kubernetes/policy/components/policy-clamp-be/templates/deployment.yaml
+++ b/kubernetes/policy/components/policy-clamp-be/templates/deployment.yaml
@@ -67,6 +67,8 @@
           - |
           {{- if .Values.global.aafEnabled }}
             export $(grep '^cadi_' {{ .Values.certInitializer.credsPath }}/org.onap.clamp.cred.props | xargs -0)
+            export SDC_CLIENT_PASSWORD_ENC=`java -jar {{ .Values.certInitializer.credsPath }}/aaf-cadi-aaf-2.1.20-full.jar cadi digest ${SDC_CLIENT_PASSWORD} {{ .Values.certInitializer.credsPath }}/org.onap.clamp.keyfile`;
+            envsubst < "/opt/policy/clamp/sdc-controllers-config.json" > "/opt/policy/clamp/sdc-controllers-config-pass.json"
           {{- end }}
             java -Djava.security.egd=file:/dev/./urandom ${JAVA_RAM_CONFIGURATION} -jar ./policy-clamp-backend.jar
           ports:
@@ -99,6 +101,8 @@
             {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-creds" "key" "login") | indent 12 }}
           - name: MYSQL_PASSWORD
             {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-creds" "key" "password") | indent 12 }}
+          - name: SDC_CLIENT_PASSWORD
+            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "sdc-creds" "key" "password") | indent 12 }}
           {{-  if ne "unlimited" (include "common.flavor" .) }}
           - name: JAVA_RAM_CONFIGURATION
             value: -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=75
diff --git a/kubernetes/policy/components/policy-clamp-be/values.yaml b/kubernetes/policy/components/policy-clamp-be/values.yaml
index ef0ea7a..71d2517 100644
--- a/kubernetes/policy/components/policy-clamp-be/values.yaml
+++ b/kubernetes/policy/components/policy-clamp-be/values.yaml
@@ -44,10 +44,7 @@
   app_ns: org.osaaf.aaf
   credsPath: /opt/app/osaaf/local
   aaf_add_config: >
-    echo "$cadi_truststore_password" > {{ .Values.credsPath }}/cadi_truststore_password.pwd;
-    echo "$cadi_key_password" > {{ .Values.credsPath }}/cadi_key_password.pwd;
-    echo "$cadi_keystore_password" > {{ .Values.credsPath }}/cadi_keystore_password.pwd;
-    echo "$cadi_keystore_password_p12" > {{ .Values.credsPath }}/cadi_keystore_password_p12.pwd;
+    /opt/app/aaf_config/bin/agent.sh local showpass {{.Values.fqi}} {{ .Values.fqdn }} > {{ .Values.credsPath }}/mycreds.prop;
     cd {{ .Values.credsPath }};
     chmod a+rx *;
 
@@ -58,11 +55,16 @@
     login: '{{ .Values.db.user }}'
     password: '{{ .Values.db.password }}'
     passwordPolicy: required
+  - uid: sdc-creds
+    type: password
+    externalSecret: '{{ tpl (default "" .Values.sdc.sdcClientExternalSecret) . }}'
+    password: '{{ .Values.sdc.clientPassword }}'
+    passwordPolicy: required
 
 flavor: small
 
 # application image
-image: onap/policy-clamp-backend:6.0.2
+image: onap/policy-clamp-backend:6.1.1
 pullPolicy: Always
 
 # flag to enable debugging - application support required
@@ -78,6 +80,9 @@
 
 #####dummy values for db user and password to pass lint!!!#######
 
+sdc:
+  clientPassword: Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U
+
 db:
   user: policy_user
   password: policy_user
diff --git a/kubernetes/policy/components/policy-clamp-fe/values.yaml b/kubernetes/policy/components/policy-clamp-fe/values.yaml
index c824965..9712a38 100644
--- a/kubernetes/policy/components/policy-clamp-fe/values.yaml
+++ b/kubernetes/policy/components/policy-clamp-fe/values.yaml
@@ -60,7 +60,7 @@
 flavor: small
 
 # application image
-image: onap/policy-clamp-frontend:6.0.2
+image: onap/policy-clamp-frontend:6.1.1
 pullPolicy: Always
 
 # flag to enable debugging - application support required
diff --git a/kubernetes/portal/components/portal-mariadb/resources/config/mariadb/docker-entrypoint.sh b/kubernetes/portal/components/portal-mariadb/resources/config/mariadb/docker-entrypoint.sh
index 390241f..c4a21b9 100644
--- a/kubernetes/portal/components/portal-mariadb/resources/config/mariadb/docker-entrypoint.sh
+++ b/kubernetes/portal/components/portal-mariadb/resources/config/mariadb/docker-entrypoint.sh
@@ -107,7 +107,7 @@
 		if [ -z "$DATABASE_ALREADY_EXISTS" ]; then
 			extraArgs+=( '--dont-use-mysql-root-password' )
 		fi
-		if docker_process_sql "${extraArgs[@]}" --database=mysql <<<'SELECT 1' &> /dev/null; then
+		if echo 'SELECT 1' |docker_process_sql "${extraArgs[@]}" --database=mysql >/dev/null 2>&1; then
 			break
 		fi
 		sleep 1
@@ -263,19 +263,19 @@
 	# Creates a custom database and user if specified
 	if [ -n "$MYSQL_DATABASE" ]; then
 		mysql_note "Creating database ${MYSQL_DATABASE}"
-		docker_process_sql --database=mysql <<<"CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;"
+		echo "CREATE DATABASE IF NOT EXISTS \`$MYSQL_DATABASE\` ;" |docker_process_sql --database=mysql
 	fi
 
 	if [ -n "$MYSQL_USER" ] && [ -n "$MYSQL_PASSWORD" ]; then
 		mysql_note "Creating user ${MYSQL_USER}"
-		docker_process_sql --database=mysql <<<"CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;"
+		echo "CREATE USER '$MYSQL_USER'@'%' IDENTIFIED BY '$MYSQL_PASSWORD' ;" |docker_process_sql --database=mysql
 
 		if [ -n "$MYSQL_DATABASE" ]; then
 			mysql_note "Giving user ${MYSQL_USER} access to schema ${MYSQL_DATABASE}"
-			docker_process_sql --database=mysql <<<"GRANT ALL ON \`${MYSQL_DATABASE//_/\\_}\`.* TO '$MYSQL_USER'@'%' ;"
+			echo "GRANT ALL ON \`${MYSQL_DATABASE//_/\\_}\`.* TO '$MYSQL_USER'@'%' ;" |docker_process_sql --database=mysql
 		fi
 
-		docker_process_sql --database=mysql <<<"FLUSH PRIVILEGES ;"
+		echo "FLUSH PRIVILEGES ;" |docker_process_sql --database=mysql
 	fi
 }
 
diff --git a/kubernetes/sdc/components/sdc-onboarding-be/templates/deployment.yaml b/kubernetes/sdc/components/sdc-onboarding-be/templates/deployment.yaml
index 5c530fe..af53fd6 100644
--- a/kubernetes/sdc/components/sdc-onboarding-be/templates/deployment.yaml
+++ b/kubernetes/sdc/components/sdc-onboarding-be/templates/deployment.yaml
@@ -93,7 +93,7 @@
             memory: 20Mi
       {{- end }}
       - name: volume-permissions
-        image: {{ .Values.global.busyboxRepository | default .Values.busyboxRepository }}/{{ .Values.global.busyboxImage | default .Values.busyboxImage }}
+        image: {{ include "repositoryGenerator.image.busybox" . }}
         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
         command:
           - sh