diff --git a/kubernetes/catalog/kubernetes/kubernetes.bom b/kubernetes/catalog/kubernetes/kubernetes.bom
index 8552bb95..37cf55b2 100644
--- a/kubernetes/catalog/kubernetes/kubernetes.bom
+++ b/kubernetes/catalog/kubernetes/kubernetes.bom
@@ -70,7 +70,11 @@ brooklyn.catalog:
         - name: kubernetes.apiserver.port
           label: "Kubernetes API Server Port"
           type: integer
-          default: 8080
+          default: 8443
+        - name: kubernetes.apiserver.protocol
+          label: "Kubernetes API Server Protocol"
+          type: string
+          default: "https"
         - name: kubernetes.sharedsecuritygroup.create
           label: "Create Kubernetes SharedSecurityGroup"
           description: |
@@ -205,18 +209,17 @@ brooklyn.catalog:
         - name: kubernetes.user
           label: "Kubernetes User"
           type: string
-          default: "guest"
-        - name: kubernetes.password
-          label: "Kubernetes Password"
+          default: "admin"
+        - name: kubernetes.servicetoken.file
+          label: "Kubernetes Service Token File"
           type: string
-          default: "guest"
-        - name: kubernetes.authentication.file
-          label: "Kubernetes Authentication File"
+          default:
+            "classpath://io.brooklyn.clocker.kubernetes:kubernetes/known_tokens.csv"
+        - name: kubernetes.authorization.file
+          label: "Kubernetes Authorization File"
           type: string
-          description: |
-            Usernames and passwords in a CSV file. Used for Kubernetes API server basic authentication
           default:
-            "classpath://io.brooklyn.clocker.kubernetes:kubernetes/basic_auth.csv"
+            "classpath://io.brooklyn.clocker.kubernetes:kubernetes/policy.jsonl"
         - name: kubernetes.recovery.quarantineFailedEntities
           label: "Quarantine"
           description: |
@@ -266,7 +269,27 @@ brooklyn.catalog:
           name: "kubernetes-manager-load-balancer"
           brooklyn.config:
             haproxy.port: $brooklyn:parent().parent().config("kubernetes.apiserver.port")
-            haproxy.protocol: "http"
+            haproxy.protocol: $brooklyn:parent().parent().config("kubernetes.apiserver.protocol")
+            haproxy.bind.options:
+              $brooklyn:formatString:
+                - "ssl ca-file %1$s/ca.pem crt %1$s/cert.pem"
+                - $brooklyn:attributeWhenReady("run.dir")
+            shell.env:
+              CA_REQUEST_ROOT_URL: $brooklyn:config("ca.request.root.url")
+            resources.preInstall.latch: $brooklyn:entity("ca-server").attributeWhenReady("service.isUp")
+            files.preinstall:
+              "classpath://io.brooklyn.clocker.common:common/certificate-functions.sh": certificate-functions.sh
+            pre.launch.command: |
+              set -e
+              source ${INSTALL_DIR}/certificate-functions.sh
+
+              getcert ${CA_REQUEST_ROOT_URL}/cacert/ca.pem ${RUN_DIR}/ca.pem
+              generate_key ${RUN_DIR}/key.pem
+              generate_conf ${INSTALL_DIR}/csr.cnf ${HOST_ADDRESS} ${SUBNET_ADDRESS}
+              generate_csr ${INSTALL_DIR}/csr.cnf ${RUN_DIR}/key.pem ${INSTALL_DIR}/csr.pem
+
+              curl -X POST --data-binary @${INSTALL_DIR}/csr.pem  ${CA_REQUEST_ROOT_URL}/sign > ${RUN_DIR}/cert.pem
+              cat ${RUN_DIR}/key.pem >> ${RUN_DIR}/cert.pem
           brooklyn.enrichers:
             - type: org.apache.brooklyn.enricher.stock.Propagator
               brooklyn.config:
@@ -293,7 +316,8 @@ brooklyn.catalog:
                 enricher.targetSensor: $brooklyn:sensor("kubernetes.url")
                 enricher.targetValue:
                   $brooklyn:formatString:
-                    - "http://%s"
+                    - "%s://%s"
+                    - $brooklyn:config("haproxy.protocol")
                     - $brooklyn:attributeWhenReady("kubernetes.endpoint")
 
         - type: cluster
@@ -464,6 +488,21 @@ brooklyn.catalog:
           label: "Kubernetes Debug"
           type: boolean
           default: false
+        - name: ca.request.root.url
+          label: "CA Request Root URL"
+          description: |
+            Root URL for a CA server.
+          type: string
+        - name: ca.cert
+          label: CA Certificate
+          description: |
+            CA certificate data
+          type: string
+        - name: kubernetes.servicetoken.file
+          label: "Kubernetes Service Token File"
+          type: string
+          default:
+            "classpath://io.brooklyn.clocker.kubernetes:kubernetes/known_tokens.csv"
 
       brooklyn.config:
         childStartMode: foreground_late
@@ -479,18 +518,24 @@ brooklyn.catalog:
                   - "30000-32767"
                 enabled: $brooklyn:config("kubernetes.sharedsecuritygroup.create")
 
+        files.preinstall:
+          $brooklyn:config("kubernetes.servicetoken.file"): known_tokens.csv
+          "classpath://io.brooklyn.clocker.common:common/certificate-functions.sh": certificate-functions.sh
+
         shell.env:
+          CA_REQUEST_ROOT_URL: $brooklyn:config("ca.request.root.url")
+          CA_CERT: $brooklyn:config("ca.cert")
           KUBERNETES_VERSION: $brooklyn:entity("kubernetes-cluster").config("kubernetes.version")
           CLUSTER_NAME: $brooklyn:entity("kubernetes-cluster").config("kubernetes.cluster.name")
           KUBERNETES_USER: $brooklyn:entity("kubernetes-cluster").config("kubernetes.user")
-          KUBERNETES_PASSWORD: $brooklyn:entity("kubernetes-cluster").config("kubernetes.password")
           KUBECTL_DOWNLOAD_URL: $brooklyn:config("kubectl.download.url")
           KUBERNETES_URL: $brooklyn:entity("kubernetes-cluster").attributeWhenReady("kubernetes.url")
-          KUBERNETES_ENDPOINT: $brooklynentity("kubernetes-cluster").attributeWhenReady("kubernetes.endpoint")
+          KUBERNETES_ENDPOINT: $brooklyn:entity("kubernetes-cluster").attributeWhenReady("kubernetes.endpoint")
           HOST_ADDRESS: $brooklyn:attributeWhenReady("host.address")
           HOST_SUBNET_ADDRESS: $brooklyn:attributeWhenReady("host.subnet.address")
           ENTITY_ID: $brooklyn:attributeWhenReady("entity.id")
           KUBERNETES_DEBUG: $brooklyn:config("kubernetes.debug")
+          INSTALL_DIR: $brooklyn:attributeWhenReady("install.dir")
 
         kubectl.download.url:
           $brooklyn:formatString:
@@ -518,32 +563,25 @@ brooklyn.catalog:
           wget ${KUBECTL_DOWNLOAD_URL}
           chmod +x kubectl
           sudo cp kubectl /usr/bin
+          sudo mkdir /etc/kubernetes
+
+        post.install.command: |
+          echo "[CLOCKER] Creating CA certificate directory"
+          sudo mkdir /etc/kubernetes/certs
+          sudo chown ${USER} /etc/kubernetes/certs
+          source ${INSTALL_DIR}/certificate-functions.sh
+          getcert ${CA_REQUEST_ROOT_URL}/cacert/ca.pem /etc/kubernetes/certs/ca.pem
 
         launch.command: |
-          sudo mkdir -p /etc/kubernetes
-          sudo -E tee /etc/kubernetes/kubeconfig <<-EOF
-          current-context: default
-          apiVersion: v1
-          clusters:
-            - name: ${CLUSTER_NAME}
-              cluster:
-                server: ${KUBERNETES_URL}
-          users:
-            - name: ${KUBERNETES_USER}
-              user:
-                username: ${KUBERNETES_USER}
-                password: ${KUBERNETES_PASSWORD}
-          contexts:
-            - name: default
-              context:
-                cluster: ${CLUSTER_NAME}
-                user: ${KUBERNETES_USER}
-                namespace: default
-          EOF
-          kubectl config set-cluster ${CLUSTER_NAME} --server=${KUBERNETES_URL}
-          kubectl config set-credentials ${KUBERNETES_USER} --username=${KUBERNETES_USER} --password=${KUBERNETES_PASSWORD}
-          kubectl config set-context default --cluster=${CLUSTER_NAME} --user=${KUBERNETES_USER} --namespace=default
+          sudo mv ${INSTALL_DIR}/known_tokens.csv /etc/kubernetes
+          KUBERNETES_TOKEN=$(sudo grep ${KUBERNETES_USER} /etc/kubernetes/known_tokens.csv | cut -d, -f1)
+
+          echo "[CLOCKER] Setup the kubeconfig file"
+          kubectl config set-cluster ${CLUSTER_NAME} --server=${KUBERNETES_URL} --certificate-authority=/etc/kubernetes/certs/ca.pem --embed-certs=true
+          kubectl config set-credentials ${KUBERNETES_USER} --token=${KUBERNETES_TOKEN}
+          kubectl config set-context default --cluster=${CLUSTER_NAME} --user=${KUBERNETES_USER}
           kubectl config use-context default
+          kubectl config view --flatten | sudo tee /etc/kubernetes/kubeconfig
 
         checkRunning.command: |
           which kubectl
@@ -670,7 +708,36 @@ brooklyn.catalog:
         - name: kubernetes.apiserver.port
           label: "Kubernetes API Server Port"
           type: integer
-          default: 8080
+          default: 8443
+        - name: kubernetes.apiserver.protocol
+          label: "Kubernetes API Server TLS Protocol"
+          type: string
+          default: "https"
+        - name: kubernetes.authorization.file
+          label: "Kubernetes Authorization File"
+          type: string
+          default:
+            "classpath://io.brooklyn.clocker.kubernetes:kubernetes/policy.jsonl"
+
+      brooklyn.config:
+        files.install:
+          $brooklyn:config("kubernetes.authorization.file"): policy.jsonl
+
+        post.install.command: |
+          echo "[CLOCKER] Creating CA certificate directory"
+          sudo mkdir /etc/kubernetes/certs
+          sudo chown ${USER} /etc/kubernetes/certs
+          source ${INSTALL_DIR}/certificate-functions.sh
+          getcert ${CA_REQUEST_ROOT_URL}/cacert/ca.pem /etc/kubernetes/certs/ca.pem
+
+          echo "[CLOCKER] Requesting certificates from ${CA_REQUEST_ROOT_URL}"
+          generate_key /etc/kubernetes/certs/key.pem
+          generate_conf /etc/kubernetes/certs/csr.cnf ${HOST_ADDRESS} ${SUBNET_ADDRESS}
+          generate_csr /etc/kubernetes/certs/csr.cnf /etc/kubernetes/certs/key.pem /etc/kubernetes/certs/csr.pem
+          curl -X POST --data-binary @/etc/kubernetes/certs/csr.pem  ${CA_REQUEST_ROOT_URL}/sign > /etc/kubernetes/certs/cert.pem
+          echo "[CLOCKER] Certifcate for ${HOST_ADDRESS} received"
+
+          sudo mv ${INSTALL_DIR}/policy.jsonl /etc/kubernetes
 
       brooklyn.children:
         - type: kube-apiserver-service
@@ -709,7 +776,8 @@ brooklyn.catalog:
             enricher.targetSensor: $brooklyn:sensor("kubernetes.url")
             enricher.targetValue:
               $brooklyn:formatString:
-                - "http://%s"
+                - "%s://%s"
+                - $brooklyn:config("kubernetes.apiserver.protocol")
                 - $brooklyn:attributeWhenReady("kubernetes.endpoint")
 
   - id: kubernetes-service
@@ -742,8 +810,6 @@ brooklyn.catalog:
           K8S_SERVICE: $brooklyn:config("kubernetes.service")
           HOST_ADDRESS: $brooklyn:attributeWhenReady("host.address")
           HOST_SUBNET_ADDRESS: $brooklyn:attributeWhenReady("host.subnet.address")
-          KUBERNETES_ENDPOINT: $brooklyn:entity("kubernetes-cluster").attributeWhenReady("kubernetes.endpoint")
-          KUBERNETES_URL: $brooklyn:entity("kubernetes-cluster").attributeWhenReady("kubernetes.url")
           ETCD_ENDPOINTS: $brooklyn:entity("etcd-cluster").attributeWhenReady("etcd.urls")
           ENTITY_ID: $brooklyn:parent().attributeWhenReady("entity.id")
           APPLICATION_ID: $brooklyn:attributeWhenReady("application.id")
@@ -775,6 +841,10 @@ brooklyn.catalog:
       brooklyn.config:
         kubernetes.service: "kube-proxy"
 
+        shell.env:
+          FLANNEL_NETWORK: $brooklyn:sibling("flannel-network-agent").config("flannel.network")
+          KUBERNETES_ENDPOINT: $brooklyn:entity("kubernetes-master").attributeWhenReady("kubernetes.endpoint")
+
         customize.command: |
           sudo -E tee /etc/systemd/system/kube-proxy.service <<-EOF
           [Unit]
@@ -784,8 +854,9 @@ brooklyn.catalog:
           ExecStart=/usr/bin/kube-proxy \
             --logtostderr=true \
             --v=4 \
+            --cluster-cidr=${FLANNEL_NETWORK} \
             --masquerade-all=true \
-            --master=${KUBERNETES_URL}
+            --kubeconfig=/etc/kubernetes/kubeconfig \
           Restart=on-failure
           [Install]
           WantedBy=multi-user.target
@@ -810,11 +881,11 @@ brooklyn.catalog:
 
         shell.env:
           FLANNEL_SUBNET: $brooklyn:sibling("flannel-network-agent").attributeWhenReady("flannel.subnet")
-          KUBERNETES_URL: $brooklyn:entity("kubernetes-cluster").attributeWhenReady("kubernetes.url")
           DNS_SERVICE_IP: $brooklyn:entity("kubernetes-cluster").config("kubernetes.dns.address")
           DNS_LOCAL_DOMAIN: $brooklyn:entity("kubernetes-cluster").config("kubernetes.dns.domain")
           CADVISOR_PORT: $brooklyn:parent().config("kubernetes.cadvisor.port")
           SCHEDULABLE: $brooklyn:config("kubernetes.schedulable")
+          KUBERNETES_ENDPOINT: $brooklyn:entity("kubernetes-master").attributeWhenReady("kubernetes.endpoint")
           CLOCKER_VERSION: "2.1.0-SNAPSHOT"
 
         customize.command: |
@@ -829,8 +900,7 @@ brooklyn.catalog:
                   "log_level_stderr": "info",
                   "hostname": "${HOST_SUBNET_ADDRESS}",
                   "policy": {
-                      "type": "k8s",
-                      "k8s_api_root": "${KUBERNETES_URL}/api/v1/"
+                      "type": "k8s"
                   },
                   "kubernetes": {
                       "kubeconfig": "/etc/kubernetes/kubeconfig"
@@ -861,7 +931,7 @@ brooklyn.catalog:
             --cadvisor-port=${CADVISOR_PORT} \
             --node-ip=${HOST_SUBNET_ADDRESS} \
             --hostname-override=${HOST_SUBNET_ADDRESS} \
-            --api-servers=${KUBERNETES_URL} \
+            --require-kubeconfig \
             --kubeconfig=/etc/kubernetes/kubeconfig \
             --network-plugin-dir=/etc/cni/net.d \
             --network-plugin=cni \
@@ -889,33 +959,28 @@ brooklyn.catalog:
       type: kubernetes-service
 
       brooklyn.parameters:
-        - name: kubernetes.authentication.file
-          label: "Kubernetes Authentication File"
-          type: string
-          default:
-            "classpath://io.brooklyn.clocker.kubernetes:kubernetes/basic_auth.csv"
         - name: kubernetes.admission.control
           label: "Kubernetes Admission Control"
           type: string
           default:
-            NamespaceLifecycle,NamespaceExists,LimitRanger,ResourceQuota,AlwaysAdmit
+            NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota,AlwaysAdmit
 
       brooklyn.config:
         kubernetes.service: "kube-apiserver"
 
-        files.install:
-          $brooklyn:config("kubernetes.authentication.file"): basic_auth.csv
-
         shell.env:
           SERVICE_CLUSTER_IP_RANGE: $brooklyn:entity("kubernetes-cluster").config("kubernetes.service.cidr")
           APISERVER_PORT: $brooklyn:entity("kubernetes-master").config("kubernetes.apiserver.port")
+          APISERVER_PROTOCOL: $brooklyn:entity("kubernetes-master").config("kubernetes.apiserver.protocol")
           ADMISSION_CONTROL: $brooklyn:config("kubernetes.admission.control")
           INSTALL_DIR: $brooklyn:attributeWhenReady("install.dir")
 
-        post.install.command: |
-          sudo mv ${INSTALL_DIR}/basic_auth.csv /etc/kubernetes
-
         customize.command: |
+          if [ "${APISERVER_PROTOCOL}" == "https" ] ; then
+            PORT_CONFIG="--bind-address=0.0.0.0 --secure-port=${APISERVER_PORT}"
+          else
+            PORT_CONFIG="--insecure-bind-address=0.0.0.0 --insecure-port=${APISERVER_PORT}"
+          fi
           sudo -E tee /etc/systemd/system/kube-apiserver.service <<-EOF
           [Unit]
           Description=Kubernetes API Server
@@ -924,12 +989,19 @@ brooklyn.catalog:
             --logtostderr=true \
             --v=4 \
             --etcd-servers=${ETCD_ENDPOINTS} \
-            --insecure-bind-address=0.0.0.0 \
-            --insecure-port=${APISERVER_PORT} \
+            ${PORT_CONFIG} \
             --advertise-address=${HOST_SUBNET_ADDRESS} \
-            --basic-auth-file=/etc/kubernetes/basic_auth.csv \
+            --external-hostname=${HOST_ADDRESS} \
+            --client-ca-file=/etc/kubernetes/certs/ca.pem \
+            --tls-cert-file=/etc/kubernetes/certs/cert.pem \
+            --tls-private-key-file=/etc/kubernetes/certs/key.pem \
+            --service-account-key-file=/etc/kubernetes/certs/key.pem \
+            --authorization-mode=ABAC \
+            --authorization-policy-file=/etc/kubernetes/policy.jsonl \
+            --token-auth-file=/etc/kubernetes/known_tokens.csv \
             --allow-privileged=true \
             --service-cluster-ip-range=${SERVICE_CLUSTER_IP_RANGE} \
+            --service-node-port-range=30000-32767 \
             --runtime-config=extensions/v1beta1=true,extensions/v1beta1/networkpolicies=true \
             --admission-control=${ADMISSION_CONTROL}
           Restart=on-failure
@@ -959,8 +1031,9 @@ brooklyn.catalog:
           ExecStart=/usr/bin/kube-controller-manager \
             --logtostderr=true \
             --v=4 \
-            --master=${KUBERNETES_ENDPOINT} \
             --kubeconfig=/etc/kubernetes/kubeconfig \
+            --service-account-private-key-file=/etc/kubernetes/certs/key.pem \
+            --root-ca-file=/etc/kubernetes/certs/ca.pem \
             --allocate-node-cidrs=true \
             --configure-cloud-routes=true \
             --leader-elect=true \
@@ -991,7 +1064,7 @@ brooklyn.catalog:
             --logtostderr=true \
             --v=4 \
             --leader-elect=true \
-            --master=${KUBERNETES_ENDPOINT}
+            --kubeconfig=/etc/kubernetes/kubeconfig
           Restart=on-failure
           [Install]
           WantedBy=multi-user.target
diff --git a/kubernetes/catalog/kubernetes/pods.bom b/kubernetes/catalog/kubernetes/pods.bom
index 06bddb1f..44c3517d 100644
--- a/kubernetes/catalog/kubernetes/pods.bom
+++ b/kubernetes/catalog/kubernetes/pods.bom
@@ -102,6 +102,14 @@ brooklyn.catalog:
               kubectl get pod --namespace=${NAMESPACE} -l app=${NAME} --output=jsonpath='{range .items[0]}{.status.phase}'
 
       brooklyn.enrichers:
+        - type: org.apache.brooklyn.core.entity.lifecycle.ServiceStateLogic$ComputeServiceIndicatorsFromChildrenAndMembers
+          brooklyn.config:
+            uniqueTag: pod-service-up-logic
+            enricher.service_state.children_and_members.quorum.up: "alwaysHealthy"
+            enricher.service_state.children_and_members.quorum.running: "alwaysHealthy"
+            enricher.aggregating.fromChildren: true
+            enricher.aggregating.fromMembers: false
+            enricher.suppressDuplicates: true
         - type: org.apache.brooklyn.enricher.stock.Transformer
           brooklyn.config:
             uniqueTag: kubernetes-pod-url-publisher
diff --git a/kubernetes/examples/kubernetes.yaml b/kubernetes/examples/kubernetes.yaml
index 89fe24ee..a5dd48e5 100644
--- a/kubernetes/examples/kubernetes.yaml
+++ b/kubernetes/examples/kubernetes.yaml
@@ -10,7 +10,7 @@ location:
     region: ams01
     identity: xxxxxxxx
     credential: XXXXXXXX
-    privateKeyFile: ~/.ssh/softlayer.pem
+    privateKeyFile: "~/.ssh/softlayer.pem"
     customizers:
       - $brooklyn:object:
           type: org.apache.brooklyn.location.jclouds.softlayer.SoftLayerSameVlanLocationCustomizer
@@ -23,13 +23,14 @@ services:
     name: "kubernetes"
     brooklyn.config:
       kubernetes.debug: true
-      kubernetes.version: 1.4.3
+      kubernetes.version: 1.4.5
       start.timeout: 30m
       kubernetes.master.size: 2
       kubernetes.initial.size: 4
       kubernetes.max.size: 16
       etcd.initial.size: 3
-      kubernetes.apiserver.port: 8000
+      kubernetes.apiserver.port: 8443
+      kubernetes.apiserver.protocol: "https"
       kubernetes.scaling.cpu.limit: 0.80
       kubernetes.recovery.stabilizationDelay: 30s
       kubernetes.recovery.failOnRecurringFailuresInThisDuration: 300000
diff --git a/kubernetes/resources/kubernetes/known_tokens.csv b/kubernetes/resources/kubernetes/known_tokens.csv
new file mode 100644
index 00000000..135d3ad7
--- /dev/null
+++ b/kubernetes/resources/kubernetes/known_tokens.csv
@@ -0,0 +1 @@
+DwYThAUb63Mu4au35XHnbe3Y3cTu5u8j,admin,admin
diff --git a/kubernetes/resources/kubernetes/kube-dns.yaml b/kubernetes/resources/kubernetes/kube-dns.yaml
index 0b98cf2b..484bfe55 100644
--- a/kubernetes/resources/kubernetes/kube-dns.yaml
+++ b/kubernetes/resources/kubernetes/kube-dns.yaml
@@ -1,5 +1,5 @@
-apiVersion: v1
 kind: Service
+apiVersion: v1
 metadata:
   name: kube-dns
   namespace: kube-system
@@ -7,7 +7,7 @@ metadata:
     app: kube-dns
     name: kube-dns-service
     kubernetes.io/cluster-service: "true"
-    kubernetes.io/name: "KubeDNS"
+    kubernetes.io/name: "kube-dns"
 spec:
   selector:
     app: kube-dns
@@ -30,6 +30,7 @@ metadata:
     name: kube-dns-replicationcontroller
     version: v20
     kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "kube-dns"
 spec:
   replicas: ${config['template.substitutions']['replicas']}
   selector:
@@ -71,10 +72,14 @@ spec:
             scheme: HTTP
           initialDelaySeconds: 30
           timeoutSeconds: 5
+        volumeMounts:
+          - mountPath: "/etc/kubernetes/kubeconfig"
+            name: kubeconfig
+            readOnly: true
         args:
           - --domain=${config['template.substitutions']['dns_service_domain']}.local.
           - --dns-port=10053
-          - --kube-master-url=${config['template.substitutions']['kubernetes_url']}
+          - --kubecfg-file=/etc/kubernetes/kubeconfig
         ports:
           - containerPort: 10053
             name: dns-local
@@ -113,4 +118,8 @@ spec:
         ports:
           - containerPort: 8080
             protocol: TCP
-      dnsPolicy: Default
\ No newline at end of file
+    volumes:
+      - name: kubeconfig
+        hostPath:
+          path: "/etc/kubernetes/kubeconfig"
+    dnsPolicy: Default
diff --git a/kubernetes/resources/kubernetes/kubernetes-dashboard.yaml b/kubernetes/resources/kubernetes/kubernetes-dashboard.yaml
index 1143d3a5..5d7f9fcd 100644
--- a/kubernetes/resources/kubernetes/kubernetes-dashboard.yaml
+++ b/kubernetes/resources/kubernetes/kubernetes-dashboard.yaml
@@ -7,11 +7,14 @@ metadata:
     app: kubernetes-dashboard
     name: kubernetes-dashboard-deployment
     version: v1.4.1
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "kubernetes-dashboard"
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: kubernetes-dashboard
+      kubernetes.io/cluster-service: "true"
   template:
     metadata:
       labels:
@@ -19,22 +22,33 @@ spec:
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ''
         scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
+        version: v1.4.1
+        kubernetes.io/cluster-service: "true"
     spec:
       containers:
       - name: kubernetes-dashboard
         image: gcr.io/google_containers/kubernetes-dashboard-amd64:v1.4.1
         imagePullPolicy: Always
         ports:
-        - containerPort: 9090
-          protocol: TCP
-        args:
-        - --apiserver-host=${config['template.substitutions']['kubernetes_url']}
+          - containerPort: 9090
+            protocol: TCP
+        volumeMounts:
+          - mountPath: "/etc/kubernetes/kubeconfig"
+            name: kubeconfig
+            readOnly: true
+        env:
+          - name: KUBECONFIG
+            value: "/etc/kubernetes/kubeconfig"
         livenessProbe:
           httpGet:
             path: /
             port: 9090
           initialDelaySeconds: 30
           timeoutSeconds: 30
+      volumes:
+        - name: kubeconfig
+          hostPath:
+            path: "/etc/kubernetes/kubeconfig"
 ---
 kind: Service
 apiVersion: v1
@@ -47,7 +61,7 @@ metadata:
 spec:
   type: NodePort
   ports:
-  - port: 80
-    targetPort: 9090
+    - port: 80
+      targetPort: 9090
   selector:
     app: kubernetes-dashboard
diff --git a/kubernetes/resources/kubernetes/policy.jsonl b/kubernetes/resources/kubernetes/policy.jsonl
new file mode 100644
index 00000000..6c5a8eb8
--- /dev/null
+++ b/kubernetes/resources/kubernetes/policy.jsonl
@@ -0,0 +1,4 @@
+{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "admin", "namespace": "*", "resource": "*", "apiGroup": "*"}}
+{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "pods", "readonly": true}}
+{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "events"}}
+{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "*", "readonly": true, "nonResourcePath": "*"}}
diff --git a/kubernetes/resources/kubernetes/prometheus.yaml b/kubernetes/resources/kubernetes/prometheus.yaml
index 7ce5ca59..94af9c47 100644
--- a/kubernetes/resources/kubernetes/prometheus.yaml
+++ b/kubernetes/resources/kubernetes/prometheus.yaml
@@ -7,7 +7,7 @@ metadata:
     app: prometheus
     name: prometheus-service
   annotations:
-    prometheus.io/scrape: 'true'
+    prometheus.io/scrape: "true"
 spec:
   selector:
     app: prometheus
@@ -26,12 +26,20 @@ metadata:
   labels:
     app: prometheus
     name: prometheus-deployment
+    version: v1.1.3
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "prometheus"
 spec:
   replicas: 1
+  selector:
+    app: prometheus
+    kubernetes.io/cluster-service: "true"
   template:
     metadata:
       labels:
         app: prometheus
+        version: v1.1.3
+        kubernetes.io/cluster-service: "true"
     spec:
       containers:
       - image: quay.io/prometheus/prometheus:v1.1.3
@@ -65,8 +73,8 @@ spec:
           configMap:
             name: prometheus-config
 ---
-apiVersion: v1
 kind: ConfigMap
+apiVersion: v1
 metadata:
   name: prometheus-config
   namespace: kube-system
@@ -81,38 +89,37 @@ data:
           - targets:
               - localhost:9090
       - job_name: 'kubernetes-cluster'
+        scheme: https
+        tls_config:
+          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
         kubernetes_sd_configs:
           - api_servers:
-              - ${config['template.substitutions']['kubernetes_url']}
-            basic_auth:
-              username: prometheus
-              password: pr0m3th3us
+              - https://kubernetes.default.svc
+            in_cluster: true
             role: apiserver
       - job_name: 'kubernetes-nodes'
+        scheme: https
+        tls_config:
+          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
         kubernetes_sd_configs:
           - api_servers:
-              - ${config['template.substitutions']['kubernetes_url']}
-            basic_auth:
-              username: prometheus
-              password: pr0m3th3us
+              - https://kubernetes.default.svc
+            in_cluster: true
             role: node
         relabel_configs:
           - action: labelmap
             regex: __meta_kubernetes_node_label_(.+)
-          - source_labels: [__meta_kubernetes_role]
-            action: replace
-            target_label: kubernetes_role
-          - source_labels: [__address__]
-            regex: (.*):10250
-            replacement: ${r"${1}:10255"}
-            target_label: __address__
       - job_name: 'kubernetes-service-endpoints'
+        scheme: https
+        tls_config:
+          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
         kubernetes_sd_configs:
           - api_servers:
-              - ${config['template.substitutions']['kubernetes_url']}
-            basic_auth:
-              username: prometheus
-              password: pr0m3th3us
+              - https://kubernetes.default.svc
+            in_cluster: true
             role: endpoint
         relabel_configs:
           - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
@@ -138,4 +145,4 @@ data:
             target_label: kubernetes_namespace
           - source_labels: [__meta_kubernetes_service_name]
             action: replace
-            target_label: kubernetes_name
\ No newline at end of file
+            target_label: kubernetes_name