diff --git a/Chart.yaml b/Chart.yaml
index bc1a616..5a4ff00 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -1,4 +1,4 @@
-name: drone
+name: drone-helm-chart
 home: https://drone.io/
 icon: https://drone.io/apple-touch-icon.png
 version: 1.0.0-rc.3
diff --git a/README.md b/README.md
index 07b99e6..eba5ef0 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,7 @@ helm install .
 ```
 
 ## Installing the Chart
-Running drone on kubernetes requires a service account that has rbac privileges to create namespaces.  Since this is a clusterrole, which cannot installed by most tiller installs, manual set-up is needed.
+Running drone on kubernetes requires running with a service account that has rbac privileges to create namespaces.  Since this is a clusterrole, which cannot installed by most tiller installs, manual set up is needed.
 
 The following will install a service account with admin clusterrole binding in the default namespace:
 
@@ -133,12 +133,13 @@ The following table lists the configurable parameters of the drone charts and th
 | `server.host`               | Drone **server** scheme and hostname                                                          | `(internal hostname)`       |
 | `server.env`                | Drone **server** environment variables                                                        | `(default values)`          |
 | `server.envSecrets`         | Drone **server** secret environment variables                                                 | `(default values)`          |
+| `server.adminAccount`      | Drone **server** admin account - set specified user as admin                                                                  | `unset`                        |
 | `server.annotations`        | Drone **server** annotations                                                                  | `{}`                        |
 | `server.resources`          | Drone **server** pod resource requests & limits                                               | `{}`                        |
 | `server.schedulerName`      | Drone **server** alternate scheduler name                                                     | `nil`                       |
 | `server.affinity`           | Drone **server** scheduling preferences                                                       | `{}`                        |
 | `server.nodeSelector`       | Drone **server** node labels for pod assignment                                               | `{}`                        |
-| `server.extraContainers`    | Additional sidecar containers                                                                 | `""`                        |
+| `server.extraContainers`    | Additional sidecar containers                                                               | `""`                        |
 | `server.extraVolumes`       | Additional volumes for use in extraContainers                                                 | `""`                        |                      |
 | `metrics.prometheus.enabled` | Enable Prometheus metrics endpoint                                                          | `false`                     |
 | `persistence.enabled`       | Use a PVC to persist data                                                                     | `true`                      |
diff --git a/templates/containers/_drone_k8s_secrets.tpl b/templates/containers/_drone_k8s_secrets.tpl
new file mode 100644
index 0000000..4ed4fb7
--- /dev/null
+++ b/templates/containers/_drone_k8s_secrets.tpl
@@ -0,0 +1,28 @@
+{{/*
+Create helm partial for drone secrets container
+*/}}
+{{- define "drone-k8s-secrets" }}
+- name: {{ template "drone.fullname" . }}-secrets
+  image: "{{ .Values.images.server.secrets }}"
+  imagePullPolicy: {{ .Values.images.server.pullPolicy }}
+  env:
+    - name: SECRET_KEY
+      valueFrom:
+        secretKeyRef:
+          name: {{ template "drone.fullname" $ }}
+          key: secretKey
+  ports:
+  - name: http
+    containerPort: 3000
+    protocol: TCP
+    readinessProbe:
+     tcpSocket:
+       port: http
+     initialDelaySeconds: 5
+     periodSeconds: 10
+    livenessProbe:
+     tcpSocket:
+       port: http
+     initialDelaySeconds: 15
+     periodSeconds: 20
+{{- end }}
diff --git a/templates/containers/_drone_server.tpl b/templates/containers/_drone_server.tpl
new file mode 100644
index 0000000..104ff7c
--- /dev/null
+++ b/templates/containers/_drone_server.tpl
@@ -0,0 +1,49 @@
+{{/*
+Create helm partial for drone server
+*/}}
+{{- define "drone" }}
+- name: {{ template "drone.fullname" . }}-server
+  image: "{{ .Values.images.server.repository }}:{{ .Values.images.server.tag }}"
+  imagePullPolicy: {{ .Values.images.server.pullPolicy }}
+  env:
+    - name: DRONE_KUBERNETES_ENABLED
+      value: "true"
+    - name: DRONE_RPC_PROTO
+      value: http
+    - name: DRONE_RPC_HOST
+      value: "{{ template "drone.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local"
+    - name: DRONE_KUBERNETES_NAMESPACE
+      value: {{ .Release.Namespace }}
+    {{- if .Values.server.adminAccount }}
+    - name: DRONE_USER_CREATE
+      value: "username:{{ .Values.server.adminAccount }},machine:false,admin:true"
+    {{- end }}
+    {{- range $key, $value := .Values.server.env }}
+    - name: {{ $key }}
+      value: {{ $value | quote }}
+    {{- end }}
+    - name: DRONE_SECRET_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: {{ template "drone.fullname" $ }}
+          key: secretKey
+    - name: DRONE_SECRET_ENDPOINT
+      value: http://localhost:3000
+  ports:
+  - name: http
+    {{- if not (.Values.server.env.DRONE_SERVER_PORT) }}
+    containerPort: 80
+    {{ else }}
+    containerPort: {{ .Values.server.env.DRONE_SERVER_PORT }}
+    {{ end -}}
+    protocol: TCP
+  livenessProbe:
+    httpGet:
+      path: /
+      port: http
+  resources:
+{{ toYaml .Values.server.resources | indent 10 }}
+  volumeMounts:
+    - name: data
+      mountPath: /data
+{{- end }}
diff --git a/templates/deployment-server.yaml b/templates/deployment-server.yaml
index 0bfa1cd..5da2d40 100644
--- a/templates/deployment-server.yaml
+++ b/templates/deployment-server.yaml
@@ -39,50 +39,9 @@ spec:
 {{- end }}
       serviceAccountName: {{ .Values.server.serviceAccount }}
       containers:
-      - name: {{ template "drone.fullname" . }}-server
-        image: "{{ .Values.images.server.repository }}:{{ .Values.images.server.tag }}"
-        imagePullPolicy: {{ .Values.images.server.pullPolicy }}
-        env:
-          - name: DRONE_KUBERNETES_ENABLED
-            value: "true"
-          - name: DRONE_RPC_PROTO
-            value: http
-          - name: DRONE_RPC_HOST
-            value: "{{ template "drone.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local"
-          - name: DRONE_KUBERNETES_NAMESPACE
-            value: {{ .Release.Namespace }}
-          {{- range $key, $value := .Values.server.envSecrets }}
-          - name: {{ $key }}
-            valueFrom:
-              secretKeyRef:
-                {{- if $.Values.existingSecret }}
-                name: {{ $.Values.existingSecret }}
-                {{ else }}
-                name: {{ template "drone.fullname" $ }}
-                {{ end -}}
-                key: {{ $key }}
-          {{- end }}
-          {{- range $key, $value := .Values.server.env }}
-          - name: {{ $key }}
-            value: {{ $value | quote }}
-          {{- end }}
-        ports:
-        - name: http
-          {{- if not (.Values.server.env.DRONE_SERVER_PORT) }}
-          containerPort: 80
-          {{ else }}
-          containerPort: {{ .Values.server.env.DRONE_SERVER_PORT }}
-          {{ end -}}
-          protocol: TCP
-        livenessProbe:
-          httpGet:
-            path: /
-            port: http
-        resources:
-{{ toYaml .Values.server.resources | indent 10 }}
-        volumeMounts:
-          - name: data
-            mountPath: /data
+      {{ include "drone" . | indent 6 }}
+      {{ include "drone-k8s-secrets" . | indent 6 }}
+
 {{- with .Values.server.extraContainers }}
 {{ tpl . $ | indent 6 }}
 {{- end }}
diff --git a/templates/secrets.yaml b/templates/secrets.yaml
index a105a33..ad4df02 100644
--- a/templates/secrets.yaml
+++ b/templates/secrets.yaml
@@ -1,4 +1,3 @@
-{{- if (not .Values.existingSecret) }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -10,7 +9,8 @@ metadata:
     heritage: "{{ .Release.Service }}"
 type: Opaque
 data:
-  {{- range $key, $value := .Values.server.envSecrets }}
-  {{ $key }}: {{ $value | b64enc }}
-  {{- end }}
+{{ if .Values.secretKey }}
+  secretKey:  {{ .Values.secretKey | b64enc | quote }}
+{{ else }}
+  secretKey: {{ randAlphaNum 16 | b64enc | quote }}
 {{ end }}
diff --git a/values.yaml b/values.yaml
index d9e5f7a..685b10f 100644
--- a/values.yaml
+++ b/values.yaml
@@ -8,6 +8,7 @@ images:
     repository: "docker.io/drone/drone"
     tag: 1.0.0-rc.3
     pullPolicy: IfNotPresent
+    secrets: docker.io/drone/kubernetes-secrets:latest
 
 service:
   httpPort: 80
@@ -52,7 +53,15 @@ ingress:
   #     hosts:
   #       - drone.domain.io
 
+# secret key used by the kubernetes secret manager - if not specified a random value is generated
+# secretKey: 1234567890ABCDEF
+
 server:
+
+
+  ## account to bootstrap as an admin user when the server starts
+  #adminAccount: octocat
+
   serviceAccount: drone-runner
 
   ## Drone server configuration.
@@ -62,17 +71,13 @@ server:
   env:
     DRONE_DEBUG: "false"
 
+    DRONE_GITHUB_SERVER: https://github.com
+    DRONE_GITHUB_SKIP_VERIFY: true
 
-    ## Drone requires some environment variables to bootstrap the
-    ## git service or it won't start up.
-    ## Uncomment this and add your own custom configuration.
-    ##
-    # DRONE_PROVIDER: "github"
-    # DRONE_OPEN: "true"
-    # DRONE_GITHUB: "true"
-    # DRONE_ORGS: "my-github-org,my-other-github-org"
-    # DRONE_ADMIN:"admin-1,admin-2"
-    # DRONE_GITHUB_CLIENT: "github-oauth2-client-id"
+    # replace with your values - TODO: use secrets
+    DRONE_GITHUB_CLIENT_ID: "1234567890"
+    DRONE_GITHUB_CLIENT_SECRET: "ABCDEFGHIHKLMNOPQRSTUBQXYZ"
+    DRONE_RPC_SECRET:
 
   ## Secret environment variables are configured in `server.envSecrets`.
   ## Each item in `server.envSecrets` references a Kubernetes Secret.