diff --git a/kubernetes/api-server/api-server-deployment.yaml b/kubernetes/api-server/api-server-deployment.yaml
index d73f3aa..b3427d1 100644
--- a/kubernetes/api-server/api-server-deployment.yaml
+++ b/kubernetes/api-server/api-server-deployment.yaml
@@ -17,31 +17,14 @@ spec:
       nodeSelector:
         kubernetes.io/arch: amd64
       containers:
-        - env:
-            - name: ENABLE_METRICS
-              value: "0"
+        - envFrom:
+          - secretRef:
+              name: jambonz
+          env:
             - name: HTTP_PORT
               value: "3000"
-            - name: JAMBONES_CLUSTER_ID
-              value: jb
-            - name: JAMBONES_LOGLEVEL
-              value: info
-            - name: JAMBONES_MYSQL_DATABASE
-              value: jambones
-            - name: JAMBONES_MYSQL_HOST
-              value: mysql
-            - name: JAMBONES_MYSQL_PASSWORD
-              value: jambones
-            - name: JAMBONES_MYSQL_USER
-              value: jambones
-            - name: JAMBONES_REDIS_HOST
-              value: redis
-            - name: JAMBONES_REDIS_PORT
-              value: "6379"
             - name: JAMBONE_API_VERSION
               value: v1
-            - name: NODE_ENV
-              value: production
           image: jambonz/jambonz-api-server:latest
           name: api-server
           ports:
diff --git a/kubernetes/call-router/call-router-deployment.yaml b/kubernetes/call-router/call-router-deployment.yaml
index 5dfbaf5..4602ffc 100644
--- a/kubernetes/call-router/call-router-deployment.yaml
+++ b/kubernetes/call-router/call-router-deployment.yaml
@@ -17,23 +17,12 @@ spec:
       nodeSelector:
         kubernetes.io/arch: amd64
       containers:
-        - env:
-            - name: ENABLE_METRICS
-              value: "0"
+        - envFrom:
+          - secretRef:
+              name: jambonz
+          env:
             - name: HTTP_PORT
               value: "4000"
-            - name: JAMBONES_INBOUND_ROUTE
-              value: 127.0.0.1:4002
-            - name: JAMBONES_LOGLEVEL
-              value: info
-            - name: JAMBONES_NETWORK_CIDR
-              value: 100.0.0.0/8
-            - name: JAMBONES_OUTBOUND_ROUTE
-              value: 127.0.0.1:4003
-            - name: JAMBONZ_TAGGED_INBOUND
-              value: "1"
-            - name: NODE_ENV
-              value: production
           image: jambonz/sbc-call-router:latest
           name: call-router
           resources: {}
diff --git a/kubernetes/jambonz.env b/kubernetes/jambonz.env
new file mode 100644
index 0000000..b816862
--- /dev/null
+++ b/kubernetes/jambonz.env
@@ -0,0 +1,21 @@
+NODE_ENV=production
+ENABLE_METRICS=0
+
+JAMBONES_CLUSTER_ID=jb
+JAMBONES_LOGLEVEL=info
+JAMBONES_TIME_SERIES_HOST=127.0.0.1
+JAMBONES_NETWORK_CIDR=10.42.0.0/16
+JAMBONES_MYSQL_DATABASE=jambones
+JAMBONES_MYSQL_HOST=mysql
+JAMBONES_MYSQL_PASSWORD=jambones
+JAMBONES_MYSQL_USER=jambones
+JAMBONES_REDIS_HOST=redis
+JAMBONES_REDIS_PORT=6379
+JAMBONES_INBOUND_ROUTE=127.0.0.1:4002
+JAMBONES_OUTBOUND_ROUTE=127.0.0.1:4003
+JAMBONZ_TAGGED_INBOUND=1
+JAMBONES_RTPENGINES=rtpengine:22222
+
+DRACHTIO_SECRET=cymru
+DRACHTIO_HOST=drachtio-sbc
+DRACHTIO_PORT=9022
diff --git a/kubernetes/kustomization.yaml b/kubernetes/kustomization.yaml
index d31ea26..9a570a7 100644
--- a/kubernetes/kustomization.yaml
+++ b/kubernetes/kustomization.yaml
@@ -25,3 +25,7 @@ resources:
 - sbc-inbound/sbc-inbound-deployment.yaml
 - sbc-outbound/sbc-outbound-deployment.yaml
 - registrar/registrar-deployment.yaml
+secretGenerator:
+  - envs:
+      - jambonz.env
+    name: jambonz
diff --git a/kubernetes/mysql/mysql-statefulset.yaml b/kubernetes/mysql/mysql-statefulset.yaml
index 56b262d..51f222e 100644
--- a/kubernetes/mysql/mysql-statefulset.yaml
+++ b/kubernetes/mysql/mysql-statefulset.yaml
@@ -23,11 +23,20 @@ spec:
             - name: MYSQL_ALLOW_EMPTY_PASSWORD
               value: "yes"
             - name: MYSQL_DATABASE
-              value: jambones
+              valueFrom:
+                secretKeyRef:
+                  name: jambonz
+                  key: JAMBONES_MYSQL_DATABASE
             - name: MYSQL_PASSWORD
-              value: jambones
+              valueFrom:
+                secretKeyRef:
+                  name: jambonz
+                  key: JAMBONES_MYSQL_PASSWORD
             - name: MYSQL_USER
-              value: jambones
+              valueFrom:
+                secretKeyRef:
+                  name: jambonz
+                  key: JAMBONES_MYSQL_USER
           image: mysql
           livenessProbe:
             exec:
diff --git a/kubernetes/registrar/registrar-deployment.yaml b/kubernetes/registrar/registrar-deployment.yaml
index 261e2de..ac7e27e 100644
--- a/kubernetes/registrar/registrar-deployment.yaml
+++ b/kubernetes/registrar/registrar-deployment.yaml
@@ -17,31 +17,9 @@ spec:
       nodeSelector:
         kubernetes.io/arch: amd64
       containers:
-        - env:
-            - name: DRACHTIO_HOST
-              value: drachtio-sbc
-            - name: DRACHTIO_PORT
-              value: "9022"
-            - name: DRACHTIO_SECRET
-              value: cymru
-            - name: ENABLE_METRICS
-              value: "0"
-            - name: JAMBONES_LOGLEVEL
-              value: info
-            - name: JAMBONES_MYSQL_DATABASE
-              value: jambones
-            - name: JAMBONES_MYSQL_HOST
-              value: mysql
-            - name: JAMBONES_MYSQL_PASSWORD
-              value: jambones
-            - name: JAMBONES_MYSQL_USER
-              value: jambones
-            - name: JAMBONES_REDIS_HOST
-              value: redis
-            - name: JAMBONES_REDIS_PORT
-              value: "6379"
-            - name: NODE_ENV
-              value: production
+        - envFrom:
+          - secretRef:
+              name: jambonz
           image: jambonz/sbc-registrar:latest
           name: registrar
           resources: {}
diff --git a/kubernetes/sbc-inbound/sbc-inbound-deployment.yaml b/kubernetes/sbc-inbound/sbc-inbound-deployment.yaml
index e2c8164..282f42d 100644
--- a/kubernetes/sbc-inbound/sbc-inbound-deployment.yaml
+++ b/kubernetes/sbc-inbound/sbc-inbound-deployment.yaml
@@ -17,35 +17,9 @@ spec:
       nodeSelector:
         kubernetes.io/arch: amd64
       containers:
-        - env:
-            - name: DRACHTIO_HOST
-              value: drachtio-sbc
-            - name: DRACHTIO_PORT
-              value: "9022"
-            - name: DRACHTIO_SECRET
-              value: cymru
-            - name: ENABLE_METRICS
-              value: "0"
-            - name: JAMBONES_CLUSTER_ID
-              value: jb
-            - name: JAMBONES_LOGLEVEL
-              value: info
-            - name: JAMBONES_MYSQL_DATABASE
-              value: jambones
-            - name: JAMBONES_MYSQL_HOST
-              value: mysql
-            - name: JAMBONES_MYSQL_PASSWORD
-              value: jambones
-            - name: JAMBONES_MYSQL_USER
-              value: jambones
-            - name: JAMBONES_REDIS_HOST
-              value: redis
-            - name: JAMBONES_REDIS_PORT
-              value: "6379"
-            - name: JAMBONES_RTPENGINES
-              value: rtpengine:22222
-            - name: NODE_ENV
-              value: production
+        - envFrom:
+          - secretRef:
+              name: jambonz
           image: jambonz/sbc-inbound:latest
           name: sbc-inbound
           resources: {}
diff --git a/kubernetes/sbc-outbound/sbc-outbound-deployment.yaml b/kubernetes/sbc-outbound/sbc-outbound-deployment.yaml
index 0fcb291..fab9da7 100644
--- a/kubernetes/sbc-outbound/sbc-outbound-deployment.yaml
+++ b/kubernetes/sbc-outbound/sbc-outbound-deployment.yaml
@@ -17,35 +17,9 @@ spec:
       nodeSelector:
         kubernetes.io/arch: amd64
       containers:
-        - env:
-            - name: DRACHTIO_HOST
-              value: drachtio-sbc
-            - name: DRACHTIO_PORT
-              value: "9022"
-            - name: DRACHTIO_SECRET
-              value: cymru
-            - name: ENABLE_METRICS
-              value: "0"
-            - name: JAMBONES_CLUSTER_ID
-              value: jb
-            - name: JAMBONES_LOGLEVEL
-              value: info
-            - name: JAMBONES_MYSQL_DATABASE
-              value: jambones
-            - name: JAMBONES_MYSQL_HOST
-              value: mysql
-            - name: JAMBONES_MYSQL_PASSWORD
-              value: jambones
-            - name: JAMBONES_MYSQL_USER
-              value: jambones
-            - name: JAMBONES_REDIS_HOST
-              value: redis
-            - name: JAMBONES_REDIS_PORT
-              value: "6379"
-            - name: JAMBONES_RTPENGINES
-              value: rtpengine:22222
-            - name: NODE_ENV
-              value: production
+        - envFrom:
+          - secretRef:
+              name: jambonz
           image: jambonz/sbc-outbound:latest
           name: sbc-outbound
           resources: {}