diff --git a/generate-secrets.sh b/generate-secrets.sh
deleted file mode 100755
index a49ede2..0000000
--- a/generate-secrets.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-NAMESPACE="$1"
-if [[ -z $1 ]]; then
-    NAMESPACE=default
-fi
-
-kubectl -n $NAMESPACE create secret generic database-auth-secret \
---dry-run=client \
---from-literal=password=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32) \
--o yaml | \
-kubectl -n $NAMESPACE apply -f -
-
-kubectl -n $NAMESPACE create secret generic munge-key-secret \
---dry-run=client \
---from-literal=munge.key=$(dd if=/dev/urandom bs=1 count=1024 2>/dev/null | base64 -w 0) \
--o yaml | \
-kubectl -n $NAMESPACE apply -f -
-
-mkdir -p ./temphostkeys/etc/ssh
-ssh-keygen -A -f ./temphostkeys
-kubectl -n $NAMESPACE create secret generic host-keys-secret \
---dry-run=client \
---from-file=./temphostkeys/etc/ssh \
--o yaml | \
-kubectl -n $NAMESPACE apply -f -
-rm -rf ./temphostkeys
-
-OOD_PASS=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 16)
-
-kubectl -n $NAMESPACE create secret generic htdbm-secret \
---dry-run=client \
---from-literal=password=$OOD_PASS \
--o yaml | \
-kubectl -n $NAMESPACE apply -f -
-
-echo "Open Ondemand Credentials:"
-echo "Username: rocky"
-echo "Password: $OOD_PASS"
-OOD_PASS=""
diff --git a/image/Dockerfile b/image/Dockerfile
index 855a1cc..0d00a6a 100644
--- a/image/Dockerfile
+++ b/image/Dockerfile
@@ -9,6 +9,8 @@ LABEL org.opencontainers.image.source="https://github.com/stackhpc/slurm-docker-
 ARG SLURM_TAG=slurm-23.02
 ARG GOSU_VERSION=1.11
 
+COPY kubernetes.repo /etc/yum.repos.d/kubernetes.repo
+
 RUN set -ex \
     && yum makecache \
     && yum -y update \
@@ -46,6 +48,7 @@ RUN set -ex \
        openssh-server \
        apptainer \
        ondemand \
+       kubectl \
     && yum clean all \
     && rm -rf /var/cache/yum
 
diff --git a/image/docker-entrypoint.sh b/image/docker-entrypoint.sh
index 762d37d..38ffacf 100755
--- a/image/docker-entrypoint.sh
+++ b/image/docker-entrypoint.sh
@@ -156,6 +156,18 @@ then
             exit 1
     fi
 
+elif [ "$1" = "generate-keys-hook" ]
+then
+    mkdir -p ./temphostkeys/etc/ssh
+    ssh-keygen -A -f ./temphostkeys
+    kubectl create secret generic host-keys-secret \
+    --dry-run=client \
+    --from-file=./temphostkeys/etc/ssh \
+    -o yaml | \
+    kubectl apply -f -
+    
+    exit 0
+    
 elif [ "$1" = "debug" ]
 then
     start_munge --foreground
diff --git a/image/kubernetes.repo b/image/kubernetes.repo
new file mode 100644
index 0000000..f4ae4ff
--- /dev/null
+++ b/image/kubernetes.repo
@@ -0,0 +1,6 @@
+[kubernetes]
+name=Kubernetes
+baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-$basearch
+enabled=1
+gpgcheck=1
+gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
diff --git a/slurm-cluster-chart/templates/database-auth-secret.yaml b/slurm-cluster-chart/templates/database-auth-secret.yaml
new file mode 100644
index 0000000..1a1d6ea
--- /dev/null
+++ b/slurm-cluster-chart/templates/database-auth-secret.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: database-auth-secret
+  annotations:
+    helm.sh/hook: pre-install
+data:
+  password: {{ randAlphaNum 32 | b64enc }}
diff --git a/slurm-cluster-chart/templates/generate-keys-hook.yaml b/slurm-cluster-chart/templates/generate-keys-hook.yaml
new file mode 100644
index 0000000..c05e7f2
--- /dev/null
+++ b/slurm-cluster-chart/templates/generate-keys-hook.yaml
@@ -0,0 +1,22 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: generate-keys-hook
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": hook-succeeded
+    "helm.sh/hook-weight": "3"
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 0
+  template:
+    metadata:
+      name: generate-keys-hook
+    spec:
+      serviceAccountName: secret-generator-account
+      restartPolicy: Never
+      containers:
+      - name: generate-keys-hook
+        image: {{ .Values.slurmImage }}
+        args:
+          - generate-keys-hook
diff --git a/slurm-cluster-chart/templates/helm-authorized-keys-configmap.yaml b/slurm-cluster-chart/templates/helm-authorized-keys-configmap.yaml
new file mode 100644
index 0000000..75ad249
--- /dev/null
+++ b/slurm-cluster-chart/templates/helm-authorized-keys-configmap.yaml
@@ -0,0 +1,9 @@
+#Only applied if sshPublicKey provided in values.yaml, if not assumes you have run publish-keys.sh prior to helm release
+{{ if .Values.sshPublicKey }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: helm-authorized-keys-configmap
+data:
+  authorized_keys: {{ .Values.sshPublicKey }}
+{{ end }}
diff --git a/slurm-cluster-chart/templates/login.yaml b/slurm-cluster-chart/templates/login.yaml
index f9700bf..d77aae2 100644
--- a/slurm-cluster-chart/templates/login.yaml
+++ b/slurm-cluster-chart/templates/login.yaml
@@ -28,10 +28,7 @@ spec:
           name: login
           env:
             - name: ROCKY_OOD_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: htdbm-secret
-                  key: password
+              value: {{ .Values.openOnDemand.password }}
             - name: JUPYTER_REPO
               value: {{ .Values.jupyterApp.repoURL }}
             - name: JUPYTER_TAG
@@ -87,7 +84,11 @@ spec:
             defaultMode: 0400
         - name: authorized-keys
           configMap:
-            name: {{ .Values.configmaps.authorizedKeys }}
+            {{ if .Values.sshPublicKey }}
+            name: helm-authorized-keys-configmap
+            {{ else }}
+            name: authorized-keys-configmap
+            {{ end }}
         - name: cluster-config
           configMap:
             name: cluster-config
diff --git a/slurm-cluster-chart/templates/munge-key-secret.yaml b/slurm-cluster-chart/templates/munge-key-secret.yaml
new file mode 100644
index 0000000..df97e19
--- /dev/null
+++ b/slurm-cluster-chart/templates/munge-key-secret.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: munge-key-secret
+  annotations:
+    helm.sh/hook: pre-install
+data:
+  munge.key: {{ randAscii 128 | b64enc }}
diff --git a/slurm-cluster-chart/templates/mysql-deployment.yaml b/slurm-cluster-chart/templates/mysql-deployment.yaml
index 8ffd49e..96dc88f 100644
--- a/slurm-cluster-chart/templates/mysql-deployment.yaml
+++ b/slurm-cluster-chart/templates/mysql-deployment.yaml
@@ -34,7 +34,7 @@ spec:
               value: "yes"
             - name: MYSQL_USER
               value: "slurm"
-          image: {{ .Values.sqlImage }}
+          image: {{ .Values.database.image }}
           name: mysql
           ports:
             - containerPort: 3306
diff --git a/slurm-cluster-chart/templates/secret-generator-role.yaml b/slurm-cluster-chart/templates/secret-generator-role.yaml
new file mode 100644
index 0000000..da914be
--- /dev/null
+++ b/slurm-cluster-chart/templates/secret-generator-role.yaml
@@ -0,0 +1,28 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-generator-role
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "1"
+rules:
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["secrets"]
+  verbs: ["get","apply","create", "patch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-generator-rolebinding
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "2"
+subjects:
+  - kind: ServiceAccount
+    name: secret-generator-account
+roleRef:
+  kind: Role
+  name: secret-generator-role
+  apiGroup: rbac.authorization.k8s.io
\ No newline at end of file
diff --git a/slurm-cluster-chart/templates/secret-generator-serviceaccount.yaml b/slurm-cluster-chart/templates/secret-generator-serviceaccount.yaml
new file mode 100644
index 0000000..ce860b0
--- /dev/null
+++ b/slurm-cluster-chart/templates/secret-generator-serviceaccount.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: secret-generator-account
+  annotations:
+    "kubernetes.io/enforce-mountable-secrets": "true"
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "0"
+automountServiceAccountToken: True
+secrets:
+  - name: host-keys-secret
diff --git a/slurm-cluster-chart/templates/slurmd.yaml b/slurm-cluster-chart/templates/slurmd.yaml
index d6ace6b..dbf0c26 100644
--- a/slurm-cluster-chart/templates/slurmd.yaml
+++ b/slurm-cluster-chart/templates/slurmd.yaml
@@ -20,24 +20,23 @@ spec:
         app.kubernetes.io/name: slurm
         app.kubernetes.io/component: slurmd
     spec:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          whenUnsatisfiable: ScheduleAnyway
-          topologyKey: kubernetes.io/hostname
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: slurm
-              app.kubernetes.io/component: slurmd
       containers:
         - args:
             - slurmd
             - -F
             - -vvv
+            - -N
+            - "$(POD_NAME)"
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
           image: {{ .Values.slurmImage }}
           name: slurmd
           ports:
-            - containerPort: 6818
             - containerPort: 8888
+            - hostPort: 6818
           resources: {}
           volumeMounts:
             - mountPath: /etc/slurm/
@@ -49,6 +48,8 @@ spec:
               subPath: munge.key
           securityContext:
             privileged: true
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
       dnsConfig:
         searches:
           - slurmd.{{ .Release.Namespace }}.svc.cluster.local
diff --git a/slurm-cluster-chart/templates/var-lib-mysql-persistentvolumeclaim.yaml b/slurm-cluster-chart/templates/var-lib-mysql-persistentvolumeclaim.yaml
index 841bb0f..a5f4503 100644
--- a/slurm-cluster-chart/templates/var-lib-mysql-persistentvolumeclaim.yaml
+++ b/slurm-cluster-chart/templates/var-lib-mysql-persistentvolumeclaim.yaml
@@ -11,4 +11,4 @@ spec:
     - ReadWriteOnce
   resources:
     requests:
-      storage: {{ .Values.databaseStorage }}
+      storage: {{ .Values.database.storage }}
diff --git a/slurm-cluster-chart/values.yaml b/slurm-cluster-chart/values.yaml
index a4ce138..e612407 100644
--- a/slurm-cluster-chart/values.yaml
+++ b/slurm-cluster-chart/values.yaml
@@ -53,20 +53,34 @@ rooknfs:
 
 
 
-sqlImage: mariadb:10.10
-
-databaseStorage: 100Mi
+# Values for Slurm's database container
+database:
+  #Database image to be used
+  image: mariadb:10.10
+  #Storage requested by the var-lib-mysql volume backing the database
+  storage: 100Mi
 
+# Configmap resource names
 configmaps:
-  authorizedKeys: authorized-keys-configmap
   slurmConf: slurm-conf-configmap
   slurmdbdConf: slurmdbd-conf-configmap
   sshdConfig: sshd-config-configmap
 
+# Public key used for ssh access to the login node
+# If let undefined, assumes you have run the provided publish-keys.sh script to publish your public key prior to deployment
+sshPublicKey:
+
+# Secret resource names
 secrets:
-  databaseAuth: database-auth-secret
   mungeKey: munge-key-secret
+<<<<<<< HEAD
   
 jupyterApp:
   repoURL: "https://github.com/stackhpc/OOD-containerised-jupyter.git"
-  repoTag: "v0.1"
\ No newline at end of file
+  repoTag: "v0.1"
+=======
+
+openOnDemand:
+  #Password for default Open OnDemand user 'rocky'
+  password: password
+>>>>>>> main