From c0a57f88ddcea79e2adfe94efa52d2bcddc792c3 Mon Sep 17 00:00:00 2001
From: Krzysztof Opasiak <k.opasiak@samsung.com>
Date: Mon, 23 Mar 2020 15:50:13 +0100
Subject: [COMMON] Optimize common secret template

It turned out that our current implementation of common secret
template is really heavy which makes onap linitng extremely long.

To improve the situation let's introduce some results caching instead
of processing templates over and over.

For now we cannot simply replace common secret template because in
mariadb-init we generate list of secrets on the fly so we will need
to revisit this fragment later.

Whole series of patches managed to reduce ONAP linting time to 40
mins.

Issue-ID: OOM-2051
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Change-Id: Id2e743147afa37290df19b73feee67621f13f67c
---
 kubernetes/common/common/templates/_secret.tpl     | 494 +++++++++++++++++++++
 kubernetes/common/common/templates/_secret.yaml    | 287 ------------
 .../common/common/templates/_serviceMesh.tpl       |   2 +-
 .../common/dgbuilder/templates/configmap.yaml      |   2 +
 .../common/dgbuilder/templates/deployment.yaml     |  22 +-
 kubernetes/common/dgbuilder/templates/secrets.yaml |   4 +-
 kubernetes/common/dgbuilder/templates/service.yaml |   2 +
 .../mariadb-galera/templates/backup/cronjob.yaml   |   4 +-
 .../common/mariadb-galera/templates/configmap.yaml |   2 +
 kubernetes/common/mariadb-galera/templates/pv.yaml |   1 +
 .../common/mariadb-galera/templates/secrets.yaml   |   5 +-
 .../common/mariadb-galera/templates/service.yaml   |   2 +
 .../mariadb-galera/templates/statefulset.yaml      |   8 +-
 .../network-name-gen/templates/deployment.yaml     |   6 +-
 .../common/network-name-gen/templates/secrets.yaml |   4 +-
 .../common/network-name-gen/templates/service.yaml |   3 +
 .../common/postgres/templates/_deployment.tpl      |  16 +-
 kubernetes/common/postgres/templates/secrets.yaml  |   2 +-
 18 files changed, 549 insertions(+), 317 deletions(-)
 create mode 100644 kubernetes/common/common/templates/_secret.tpl
 delete mode 100644 kubernetes/common/common/templates/_secret.yaml

diff --git a/kubernetes/common/common/templates/_secret.tpl b/kubernetes/common/common/templates/_secret.tpl
new file mode 100644
index 0000000000..a89ab6dfc7
--- /dev/null
+++ b/kubernetes/common/common/templates/_secret.tpl
@@ -0,0 +1,494 @@
+{{/*
+# Copyright © 2019 AT&T, Samsung Electronics
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+
+{{/*
+  For internal use only!
+
+  Generates a secret header with given name and desired labels.
+
+  The template takes two arguments:
+    - .global: environment (.)
+    - .name: name of the secret
+    - .annotations: annotations which should be used
+
+  Example call:
+    {{ include "common.secret._header" (dict "global" . "name" "myFancyName") }}
+*/}}
+{{- define "common.secret._header" -}}
+{{- $global := .global }}
+{{- $name := .name }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  namespace: {{ include "common.namespace" $global }}
+  labels:
+    app: {{ include "common.name" $global }}
+    chart: {{ $global.Chart.Name }}-{{ $global.Chart.Version | replace "+" "_" }}
+    release: {{ include "common.release" $global }}
+    heritage: {{ $global.Release.Service }}
+{{- if .annotations }}
+  annotations: {{- include "common.tplValue" (dict "value" .annotations "context" $global) | nindent 4 }}
+{{- end }}
+type: Opaque
+{{- end -}}
+
+{{/*
+  For internal use only!
+
+  Pick a value based on "user input" and generation policy.
+
+  The template takes below arguments:
+    - .global: environment (.)
+    - .secretName: name of the secret where the value will be placed
+    - .secretEnv: map of values which configures this secret. This can contain below keys:
+        - value: Value of secret key provided by user (can be a template inside a string)
+        - policy: What to do if value is missing or empty. Possible options are:
+            - generate: Generate a new password deriving it from master password
+            - required: Fail the deployment if value has not been provided
+          Defaults to generate.
+        - name: Name of the key to which this value should be assigned
+*/}}
+{{- define "common.secret._value" -}}
+  {{- $global := .global }}
+  {{- $name := .secretName }}
+  {{- $secretEnv := .secretEnv }}
+  {{- $value := tpl $secretEnv.value $global }}
+  {{- $policy := default "generate" $secretEnv.policy }}
+
+  {{- if $value }}
+    {{- $value | quote }}
+  {{- else if eq $policy "generate" }}
+    {{- include "common.createPassword" (dict "dot" $global "uid" $name) | quote }}
+  {{- else }}
+    {{- fail (printf "Value for %s secret %s key not provided" $name $secretEnv.name) }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+  For internal use only!
+
+  Pick a value based on "user input" and generation policy.
+
+  The template takes below arguments:
+    - .global: environment (.)
+    - .secretName: name of the secret where the value will be placed
+    - .secretEnv: map of values which configures this secret. This can contain below keys:
+        - value: Value of secret key provided by user (can be a template inside a string)
+        - policy: What to do if value is missing or empty. Possible options are:
+            - generate: Generate a new password deriving it from master password
+            - required: Fail the deployment if value has not been provided
+          Defaults to generate.
+        - name: Name of the key to which this value should be assigned
+*/}}
+{{- define "common.secret._valueFast" -}}
+  {{- $global := .global }}
+  {{- $name := .secretName }}
+  {{- $secretEnv := .secretEnv }}
+  {{- $value := $secretEnv.value }}
+  {{- $policy := default "generate" $secretEnv.policy }}
+
+  {{- if $value }}
+    {{- $value | quote }}
+  {{- else if eq $policy "generate" }}
+    {{- include "common.createPassword" (dict "dot" $global "uid" $name) | quote }}
+  {{- else }}
+    {{- fail (printf "Value for %s secret %s key not provided" $name $secretEnv.name) }}
+  {{- end }}
+{{- end -}}
+
+
+{{/*
+  Generate a secret name based on provided name or UID.
+  If UID is provided then the name is generated by appending this UID right after
+  the chart name. If name is provided, it overrides the name generation algorith
+  and is used right away. Both name and uid strings may contain a template to be
+  resolved.
+
+  The template takes below arguments:
+    - .global: environment (.)
+    - .uid: string that uniquely identifies this secret within a helm chart
+    - .name: string that can be used to override default name generation algorithm
+        and provide a custom name for the secret
+*/}}
+{{- define "common.secret.genName" -}}
+  {{- $global := .global }}
+  {{- $uid := tpl (default "" .uid) $global }}
+  {{- $name := tpl (default "" .name) $global }}
+  {{- $fullname := ne (default "" .chartName) "" | ternary (include "common.fullnameExplicit" (dict "dot" $global "chartName" .chartName)) (include "common.fullname" $global) }}
+  {{- default (printf "%s-%s" $fullname $uid) $name }}
+{{- end -}}
+
+{{- define "common.secret.genNameFast" -}}
+  {{- $global := .global }}
+  {{- $uid := (default "" .uid) }}
+  {{- $name := (default "" .name) }}
+  {{- $fullname := ne (default "" .chartName) "" | ternary (include "common.fullnameExplicit" (dict "dot" $global "chartName" .chartName)) (include "common.fullname" $global) }}
+  {{- default (printf "%s-%s" $fullname $uid) $name }}
+{{- end -}}
+
+{{/*
+  Get the real secret name by UID or name, based on the configuration provided by user.
+  User may decide to not create a new secret but reuse existing one for this deployment
+  (aka externalSecret). In this case the real name of secret to be used is different
+  than the one declared in secret definition. This easily retrieve current secret real
+  name based on declared name or UID even if it has been overrided by the user using
+  externalSecret option. You should use this template always when you need to reference
+  a secret created using common.secret template by name.
+
+  The template takes below arguments:
+    - .global: environment (.)
+    - .uid: string that uniquely identifies this secret within a helm chart
+        (can be omitted if name has been provided)
+    - .name: name which was used to declare a secret
+        (can be omitted if uid has been provided)
+*/}}
+{{- define "common.secret.getSecretName" -}}
+  {{- $global := .global }}
+  {{- $name := tpl (default "" .name) $global }}
+  {{- $uid := tpl (default "" .uid) $global }}
+  {{- $targetName := default (include "common.secret.genName" (dict "global" $global "uid" $uid "name" .name)) $name}}
+  {{- range $secret := $global.Values.secrets }}
+    {{- $currUID := tpl (default "" $secret.uid) $global }}
+    {{- $givenName := tpl (default "" $secret.name) $global }}
+    {{- $currName := default (include "common.secret.genName" (dict "global" $global "uid" $currUID "name" $secret.name)) $givenName }}
+    {{- if or (eq $uid $currUID) (eq $currName $targetName) }}
+      {{- $externalSecret := tpl (default "" $secret.externalSecret) $global }}
+      {{- default $currName $externalSecret }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{- define "common.secret.getSecretNameFast" -}}
+  {{- $global := .global }}
+  {{- include "common.secret.buildCache" $global }}
+  {{- $secretsCache := $global.Values._secretsCache }}
+  {{- $uid := tpl .uid $global }}
+  {{- $secret := index $secretsCache $uid }}
+  {{- $secret.realName }}
+{{- end -}}
+
+{{- define "common.secret.buildCache" -}}
+  {{- $global := . }}
+  {{- if not $global.Values._secretsCache }}
+    {{- $secretCache := dict }}
+    {{- range $secret := .Values.secrets }}
+      {{- $entry := dict }}
+      {{- $uid := tpl (default "" $secret.uid) $global }}
+      {{- $keys := keys $secret }}
+      {{- range $key := (without $keys "annotations" )}}
+        {{- $_ := set $entry $key (tpl (index $secret $key) $global) }}
+      {{- end }}
+      {{- if $secret.annotations }}
+        {{- $_ := set $entry "annotations" $secret.annotations }}
+      {{- end }}
+      {{- $realName := default (include "common.secret.genNameFast" (dict "global" $global "uid" $uid "name" $entry.name) ) $entry.externalSecret }}
+      {{- $_ := set $entry "realName" $realName }}
+      {{- $_ := set $secretCache $uid $entry }}
+    {{- end }}
+    {{- $_ := set $global.Values "_secretsCache" $secretCache }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+  Convenience template which can be used to easily set the value of environment variable
+  to the value of a key in a secret.
+
+  It takes care of all name mangling, usage of external secrets etc.
+
+  The template takes below arguments:
+    - .global: environment (.)
+    - .uid: string that uniquely identifies this secret within a helm chart
+        (can be omitted if name has been provided)
+    - .name: name which was used to declare a secret
+        (can be omitted if uid has been provided)
+    - .key: Key within this secret which value should be assigned to this variable
+
+  Example usage:
+  env:
+    - name: SECRET_PASSWORD
+      {{- include "common.secret.envFromSecret" (dict "global" . "uid" "secret" "key" "password") | indent 8}}
+*/}}
+{{- define "common.secret.envFromSecret" -}}
+  {{- $key := .key }}
+valueFrom:
+  secretKeyRef:
+    name: {{ include "common.secret.getSecretName" . }}
+    key: {{ $key }}
+{{- end -}}
+
+{{- define "common.secret.envFromSecretFast" -}}
+  {{- $key := .key }}
+valueFrom:
+  secretKeyRef:
+    name: {{ include "common.secret.getSecretNameFast" . }}
+    key: {{ $key }}
+{{- end -}}
+
+{{/*
+  Define secrets to be used by chart.
+  Every secret has a type which is one of:
+    - generic:
+        Generic secret template that allows to input some raw data (from files).
+        File Input can be passed as list of files (filePaths) or as a single string
+        (filePath)
+    - genericKV:
+        Type of secret which allows you to define a list of key value pairs.
+        The list is assiged to envs value. Every item may define below items:
+          - name:
+              Identifier of this value within secret
+          - value:
+              String that defines a value associated with given key.
+              This can be a simple string or a template.
+          - policy:
+              Defines what to do if value is not provided by the user.
+              Available options are:
+                - generate:
+                    Generate a value by derriving it from master password
+                - required:
+                    Fail the deployment
+    - password:
+        Type of secret that holds only the password.
+        Only two items can be defined for this type:
+          - password:
+              Equivalent of value field from genericKV
+          - policy:
+              The same meaning as for genericKV policy field
+    - basicAuth:
+        Type of secret that holds both username and password.
+        Below fields are available:
+          - login:
+              The value for login key.
+              This can be a simple string or a template.
+              Providing a value for login is always required.
+          - password:
+              The value for password key.
+              This can be a simple string or a template.
+          - passwordPolicy:
+              The same meaning as the policy field in genericKV.
+              Only the policy for password can be set.
+
+  Every secret can be identified using:
+    - uid:
+        A string to be appended to the chart fullname to generate a secret name.
+    - name:
+        Overrides default secret name generation and allows to set immutable
+        and globaly unique name
+    - annotations:
+        List of annotations to be used while defining a secret
+
+  To allow sharing a secret between the components and allow to pre-deploy secrets
+  before ONAP deployment it is possible to use already existing secret instead of
+  creating a new one. For this purpose externalSecret field can be used. If value of
+  this field is evaluated to true no new secret is created, only the name of the
+  secret is aliased to the external one.
+
+  Example usage:
+    secrets.yaml:
+      {{ include "common.secret" . }}
+
+    values.yaml:
+      mysqlLogin: "root"
+
+      mysqlExternalSecret: "some-other-secret-name"
+
+      secrets:
+        - uid: "mysql"
+          externalSecret: '{{ tpl .Values.passExternalSecret . }}'
+          type: basicAuth
+          login: '{{ .Values.mysqlLogin }}'
+          mysqlPassword: '{{ .Values.mysqlPassword }}'
+          passwordPolicy: generate
+
+    In the above example new secret is not going to be created.
+    Already existing one (some-other-secret-name) is going to be used.
+    To force creating a new one, just make sure that mysqlExternalSecret
+    is not set.
+
+*/}}
+{{- define "common.secret" -}}
+  {{- $global := . }}
+  {{- range $secret := .Values.secrets }}
+    {{- $uid := tpl (default "" $secret.uid) $global }}
+    {{- $name := include "common.secret.genName" (dict "global" $global "uid" $uid "name" $secret.name) }}
+    {{- $annotations := default "" $secret.annotations }}
+    {{- $type := default "generic" $secret.type }}
+    {{- $externalSecret := tpl (default "" $secret.externalSecret) $global }}
+    {{- if not $externalSecret }}
+---
+      {{ include "common.secret._header" (dict "global" $global "name" $name "annotations" $annotations) }}
+
+      {{- if eq $type "generic" }}
+data:
+        {{- range $curFilePath := $secret.filePaths }}
+          {{ tpl ($global.Files.Glob $curFilePath).AsSecrets $global | indent 2 }}
+        {{- end }}
+        {{- if $secret.filePath }}
+          {{ tpl ($global.Files.Glob $secret.filePath).AsSecrets $global | indent 2 }}
+        {{- end }}
+      {{- else if eq $type "genericKV" }}
+stringData:
+        {{- if $secret.envs }}
+          {{- range $secretEnv := $secret.envs }}
+            {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+    {{ $secretEnv.name }}: {{ include "common.secret._value" $valueDesc }}
+          {{- end }}
+        {{- end }}
+      {{- else if eq $type "password" }}
+        {{- $secretEnv := (dict "policy" (default "generate" $secret.policy) "name" "password" "value" $secret.password) }}
+        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+stringData:
+  password: {{ include "common.secret._value" $valueDesc }}
+      {{- else if eq $type "basicAuth" }}
+stringData:
+        {{- $secretEnv := (dict "policy" "required" "name" "login" "value" $secret.login) }}
+        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+  login: {{ include "common.secret._value" $valueDesc }}
+        {{- $secretEnv := (dict "policy" (default "generate" $secret.passwordPolicy) "name" "password" "value" $secret.password) }}
+        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+  password: {{ include "common.secret._value" $valueDesc }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
+
+{{/*
+  Define secrets to be used by chart.
+  Every secret has a type which is one of:
+    - generic:
+        Generic secret template that allows to input some raw data (from files).
+        File Input can be passed as list of files (filePaths) or as a single string
+        (filePath)
+    - genericKV:
+        Type of secret which allows you to define a list of key value pairs.
+        The list is assiged to envs value. Every item may define below items:
+          - name:
+              Identifier of this value within secret
+          - value:
+              String that defines a value associated with given key.
+              This can be a simple string or a template.
+          - policy:
+              Defines what to do if value is not provided by the user.
+              Available options are:
+                - generate:
+                    Generate a value by derriving it from master password
+                - required:
+                    Fail the deployment
+    - password:
+        Type of secret that holds only the password.
+        Only two items can be defined for this type:
+          - password:
+              Equivalent of value field from genericKV
+          - policy:
+              The same meaning as for genericKV policy field
+    - basicAuth:
+        Type of secret that holds both username and password.
+        Below fields are available:
+          - login:
+              The value for login key.
+              This can be a simple string or a template.
+              Providing a value for login is always required.
+          - password:
+              The value for password key.
+              This can be a simple string or a template.
+          - passwordPolicy:
+              The same meaning as the policy field in genericKV.
+              Only the policy for password can be set.
+
+  Every secret can be identified using:
+    - uid:
+        A string to be appended to the chart fullname to generate a secret name.
+    - name:
+        Overrides default secret name generation and allows to set immutable
+        and globaly unique name
+    - annotations:
+        List of annotations to be used while defining a secret
+
+  To allow sharing a secret between the components and allow to pre-deploy secrets
+  before ONAP deployment it is possible to use already existing secret instead of
+  creating a new one. For this purpose externalSecret field can be used. If value of
+  this field is evaluated to true no new secret is created, only the name of the
+  secret is aliased to the external one.
+
+  Example usage:
+    secrets.yaml:
+      {{ include "common.secretFast" . }}
+
+    values.yaml:
+      mysqlLogin: "root"
+
+      mysqlExternalSecret: "some-other-secret-name"
+
+      secrets:
+        - uid: "mysql"
+          externalSecret: '{{ tpl .Values.passExternalSecret . }}'
+          type: basicAuth
+          login: '{{ .Values.mysqlLogin }}'
+          mysqlPassword: '{{ .Values.mysqlPassword }}'
+          passwordPolicy: generate
+
+    In the above example new secret is not going to be created.
+    Already existing one (some-other-secret-name) is going to be used.
+    To force creating a new one, just make sure that mysqlExternalSecret
+    is not set.
+
+*/}}
+{{- define "common.secretFast" -}}
+  {{- $global := . }}
+  {{- include "common.secret.buildCache" $global }}
+  {{- range $secret := .Values._secretsCache }}
+    {{- $uid := $secret.uid }}
+    {{- $externalSecret := $secret.externalSecret }}
+    {{- if not $externalSecret }}
+      {{- $name := $secret.realName }}
+      {{- $annotations := default "" $secret.annotations }}
+      {{- $type := default "generic" $secret.type }}
+---
+      {{ include "common.secret._header" (dict "global" $global "name" $name "annotations" $annotations) }}
+
+      {{- if eq $type "generic" }}
+data:
+        {{- range $curFilePath := $secret.filePaths }}
+          {{ tpl ($global.Files.Glob $curFilePath).AsSecrets $global | indent 2 }}
+        {{- end }}
+        {{- if $secret.filePath }}
+          {{ tpl ($global.Files.Glob $secret.filePath).AsSecrets $global | indent 2 }}
+        {{- end }}
+      {{- else if eq $type "genericKV" }}
+stringData:
+        {{- if $secret.envs }}
+          {{- range $secretEnv := $secret.envs }}
+            {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+    {{ $secretEnv.name }}: {{ include "common.secret._valueFast" $valueDesc }}
+          {{- end }}
+        {{- end }}
+      {{- else if eq $type "password" }}
+        {{- $secretEnv := (dict "policy" (default "generate" $secret.policy) "name" "password" "value" $secret.password) }}
+        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+stringData:
+  password: {{ include "common.secret._valueFast" $valueDesc }}
+      {{- else if eq $type "basicAuth" }}
+stringData:
+        {{- $secretEnv := (dict "policy" "required" "name" "login" "value" $secret.login) }}
+        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+  login: {{ include "common.secret._valueFast" $valueDesc }}
+        {{- $secretEnv := (dict "policy" (default "generate" $secret.passwordPolicy) "name" "password" "value" $secret.password) }}
+        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
+  password: {{ include "common.secret._valueFast" $valueDesc }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end -}}
diff --git a/kubernetes/common/common/templates/_secret.yaml b/kubernetes/common/common/templates/_secret.yaml
deleted file mode 100644
index 9f41906c9e..0000000000
--- a/kubernetes/common/common/templates/_secret.yaml
+++ /dev/null
@@ -1,287 +0,0 @@
-{{/*
-# Copyright © 2019 AT&T, Samsung Electronics
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#       http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-*/}}
-
-{{/*
-  For internal use only!
-
-  Generates a secret header with given name and desired labels.
-
-  The template takes two arguments:
-    - .global: environment (.)
-    - .name: name of the secret
-    - .annotations: annotations which should be used
-
-  Example call:
-    {{ include "common.secret._header" (dict "global" . "name" "myFancyName") }}
-*/}}
-{{- define "common.secret._header" -}}
-{{- $global := .global }}
-{{- $name := .name }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ $name }}
-  namespace: {{ include "common.namespace" $global }}
-  labels:
-    app: {{ include "common.name" $global }}
-    chart: {{ $global.Chart.Name }}-{{ $global.Chart.Version | replace "+" "_" }}
-    release: {{ include "common.release" $global }}
-    heritage: {{ $global.Release.Service }}
-{{- if .annotations }}
-  annotations: {{- include "common.tplValue" (dict "value" .annotations "context" $global) | nindent 4 }}
-{{- end }}
-type: Opaque
-{{- end -}}
-
-{{/*
-  For internal use only!
-
-  Pick a value based on "user input" and generation policy.
-
-  The template takes below arguments:
-    - .global: environment (.)
-    - .secretName: name of the secret where the value will be placed
-    - .secretEnv: map of values which configures this secret. This can contain below keys:
-        - value: Value of secret key provided by user (can be a template inside a string)
-        - policy: What to do if value is missing or empty. Possible options are:
-            - generate: Generate a new password deriving it from master password
-            - required: Fail the deployment if value has not been provided
-          Defaults to generate.
-        - name: Name of the key to which this value should be assigned
-*/}}
-{{- define "common.secret._value" -}}
-  {{- $global := .global }}
-  {{- $name := .secretName }}
-  {{- $secretEnv := .secretEnv }}
-  {{- $value := tpl $secretEnv.value $global }}
-  {{- $policy := default "generate" $secretEnv.policy }}
-
-  {{- if $value }}
-    {{- $value | quote }}
-  {{- else if eq $policy "generate" }}
-    {{- include "common.createPassword" (dict "dot" $global "uid" $name) | quote }}
-  {{- else }}
-    {{- fail (printf "Value for %s secret %s key not provided" $name $secretEnv.name) }}
-  {{- end }}
-{{- end -}}
-
-
-{{/*
-  Generate a secret name based on provided name or UID.
-  If UID is provided then the name is generated by appending this UID right after
-  the chart name. If name is provided, it overrides the name generation algorith
-  and is used right away. Both name and uid strings may contain a template to be
-  resolved.
-
-  The template takes below arguments:
-    - .global: environment (.)
-    - .uid: string that uniquely identifies this secret within a helm chart
-    - .name: string that can be used to override default name generation algorithm
-        and provide a custom name for the secret
-*/}}
-{{- define "common.secret.genName" -}}
-  {{- $global := .global }}
-  {{- $uid := tpl (default "" .uid) $global }}
-  {{- $name := tpl (default "" .name) $global }}
-  {{- $fullname := ne (default "" .chartName) "" | ternary (include "common.fullnameExplicit" (dict "dot" $global "chartName" .chartName)) (include "common.fullname" $global) }}
-  {{- default (printf "%s-%s" $fullname $uid) $name }}
-{{- end -}}
-
-{{/*
-  Get the real secret name by UID or name, based on the configuration provided by user.
-  User may decide to not create a new secret but reuse existing one for this deployment
-  (aka externalSecret). In this case the real name of secret to be used is different
-  than the one declared in secret definition. This easily retrieve current secret real
-  name based on declared name or UID even if it has been overrided by the user using
-  externalSecret option. You should use this template always when you need to reference
-  a secret created using common.secret template by name.
-
-  The template takes below arguments:
-    - .global: environment (.)
-    - .uid: string that uniquely identifies this secret within a helm chart
-        (can be omitted if name has been provided)
-    - .name: name which was used to declare a secret
-        (can be omitted if uid has been provided)
-*/}}
-{{- define "common.secret.getSecretName" -}}
-  {{- $global := .global }}
-  {{- $name := tpl (default "" .name) $global }}
-  {{- $uid := tpl (default "" .uid) $global }}
-  {{- $targetName := default (include "common.secret.genName" (dict "global" $global "uid" $uid "name" .name)) $name}}
-  {{- range $secret := $global.Values.secrets }}
-    {{- $givenName := tpl (default "" $secret.name) $global }}
-    {{- $currUID := tpl (default "" $secret.uid) $global }}
-    {{- $currName := default (include "common.secret.genName" (dict "global" $global "uid" $currUID "name" $secret.name)) $givenName }}
-    {{- if or (eq $uid $currUID) (eq $currName $targetName) }}
-      {{- $externalSecret := tpl (default "" $secret.externalSecret) $global }}
-      {{- default $currName $externalSecret }}
-    {{- end }}
-  {{- end }}
-{{- end -}}
-
-{{/*
-  Convenience template which can be used to easily set the value of environment variable
-  to the value of a key in a secret.
-
-  It takes care of all name mangling, usage of external secrets etc.
-
-  The template takes below arguments:
-    - .global: environment (.)
-    - .uid: string that uniquely identifies this secret within a helm chart
-        (can be omitted if name has been provided)
-    - .name: name which was used to declare a secret
-        (can be omitted if uid has been provided)
-    - .key: Key within this secret which value should be assigned to this variable
-
-  Example usage:
-  env:
-    - name: SECRET_PASSWORD
-      {{- include "common.secret.envFromSecret" (dict "global" . "uid" "secret" "key" "password") | indent 8}}
-*/}}
-{{- define "common.secret.envFromSecret" -}}
-  {{- $key := .key }}
-valueFrom:
-  secretKeyRef:
-    name: {{ include "common.secret.getSecretName" . }}
-    key: {{ $key }}
-{{- end -}}
-
-{{/*
-  Define secrets to be used by chart.
-  Every secret has a type which is one of:
-    - generic:
-        Generic secret template that allows to input some raw data (from files).
-        File Input can be passed as list of files (filePaths) or as a single string
-        (filePath)
-    - genericKV:
-        Type of secret which allows you to define a list of key value pairs.
-        The list is assiged to envs value. Every item may define below items:
-          - name:
-              Identifier of this value within secret
-          - value:
-              String that defines a value associated with given key.
-              This can be a simple string or a template.
-          - policy:
-              Defines what to do if value is not provided by the user.
-              Available options are:
-                - generate:
-                    Generate a value by derriving it from master password
-                - required:
-                    Fail the deployment
-    - password:
-        Type of secret that holds only the password.
-        Only two items can be defined for this type:
-          - password:
-              Equivalent of value field from genericKV
-          - policy:
-              The same meaning as for genericKV policy field
-    - basicAuth:
-        Type of secret that holds both username and password.
-        Below fields are available:
-          - login:
-              The value for login key.
-              This can be a simple string or a template.
-              Providing a value for login is always required.
-          - password:
-              The value for password key.
-              This can be a simple string or a template.
-          - passwordPolicy:
-              The same meaning as the policy field in genericKV.
-              Only the policy for password can be set.
-
-  Every secret can be identified using:
-    - uid:
-        A string to be appended to the chart fullname to generate a secret name.
-    - name:
-        Overrides default secret name generation and allows to set immutable
-        and globaly unique name
-    - annotations:
-        List of annotations to be used while defining a secret
-
-  To allow sharing a secret between the components and allow to pre-deploy secrets
-  before ONAP deployment it is possible to use already existing secret instead of
-  creating a new one. For this purpose externalSecret field can be used. If value of
-  this field is evaluated to true no new secret is created, only the name of the
-  secret is aliased to the external one.
-
-  Example usage:
-    secrets.yaml:
-      {{ include "common.secret" . }}
-
-    values.yaml:
-      mysqlLogin: "root"
-
-      mysqlExternalSecret: "some-other-secret-name"
-
-      secrets:
-        - uid: "mysql"
-          externalSecret: '{{ tpl .Values.passExternalSecret . }}'
-          type: basicAuth
-          login: '{{ .Values.mysqlLogin }}'
-          mysqlPassword: '{{ .Values.mysqlPassword }}'
-          passwordPolicy: generate
-
-    In the above example new secret is not going to be created.
-    Already existing one (some-other-secret-name) is going to be used.
-    To force creating a new one, just make sure that mysqlExternalSecret
-    is not set.
-
-*/}}
-{{- define "common.secret" -}}
-  {{- $global := . }}
-  {{- range $secret := .Values.secrets }}
-    {{- $uid := tpl (default "" $secret.uid) $global }}
-    {{- $name := include "common.secret.genName" (dict "global" $global "uid" $uid "name" $secret.name) }}
-    {{- $annotations := default "" $secret.annotations }}
-    {{- $type := default "generic" $secret.type }}
-    {{- $externalSecret := tpl (default "" $secret.externalSecret) $global }}
-    {{- if not $externalSecret }}
----
-      {{ include "common.secret._header" (dict "global" $global "name" $name "annotations" $annotations) }}
-
-      {{- if eq $type "generic" }}
-data:
-        {{- range $curFilePath := $secret.filePaths }}
-          {{ tpl ($global.Files.Glob $curFilePath).AsSecrets $global | indent 2 }}
-        {{- end }}
-        {{- if $secret.filePath }}
-          {{ tpl ($global.Files.Glob $secret.filePath).AsSecrets $global | indent 2 }}
-        {{- end }}
-      {{- else if eq $type "genericKV" }}
-stringData:
-        {{- if $secret.envs }}
-          {{- range $secretEnv := $secret.envs }}
-            {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
-    {{ $secretEnv.name }}: {{ include "common.secret._value" $valueDesc }}
-          {{- end }}
-        {{- end }}
-      {{- else if eq $type "password" }}
-        {{- $secretEnv := (dict "policy" (default "generate" $secret.policy) "name" "password" "value" $secret.password) }}
-        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
-stringData:
-  password: {{ include "common.secret._value" $valueDesc }}
-      {{- else if eq $type "basicAuth" }}
-stringData:
-        {{- $secretEnv := (dict "policy" "required" "name" "login" "value" $secret.login) }}
-        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
-  login: {{ include "common.secret._value" $valueDesc }}
-        {{- $secretEnv := (dict "policy" (default "generate" $secret.passwordPolicy) "name" "password" "value" $secret.password) }}
-        {{- $valueDesc := (dict "global" $global "secretName" $name "secretEnv" $secretEnv) }}
-  password: {{ include "common.secret._value" $valueDesc }}
-      {{- end }}
-    {{- end }}
-  {{- end }}
-{{- end -}}
diff --git a/kubernetes/common/common/templates/_serviceMesh.tpl b/kubernetes/common/common/templates/_serviceMesh.tpl
index 6b6a26fc45..4457762754 100644
--- a/kubernetes/common/common/templates/_serviceMesh.tpl
+++ b/kubernetes/common/common/templates/_serviceMesh.tpl
@@ -1,4 +1,4 @@
-{/*
+{{/*
 # Copyright © 2020 Amdocs, Bell Canada, Orange
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/kubernetes/common/dgbuilder/templates/configmap.yaml b/kubernetes/common/dgbuilder/templates/configmap.yaml
index 828818c68d..05699e6107 100644
--- a/kubernetes/common/dgbuilder/templates/configmap.yaml
+++ b/kubernetes/common/dgbuilder/templates/configmap.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright © 2018 AT&T, Amdocs, Bell Canada
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -11,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
 
 apiVersion: v1
 kind: ConfigMap
diff --git a/kubernetes/common/dgbuilder/templates/deployment.yaml b/kubernetes/common/dgbuilder/templates/deployment.yaml
index b3f0ab05a3..e1fac77a97 100644
--- a/kubernetes/common/dgbuilder/templates/deployment.yaml
+++ b/kubernetes/common/dgbuilder/templates/deployment.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright © 2018 AT&T, Amdocs, Bell Canada
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -11,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
 
 apiVersion: extensions/v1beta1
 kind: Deployment
@@ -38,25 +40,25 @@ spec:
         - "cd /config-input && for PFILE in `ls -1 .`; do envsubst <${PFILE} >/config/${PFILE}; done"
         env:
         - name: DB_USER
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "db-user-creds" "key" "login") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-user-creds" "key" "login") | indent 10 }}
         - name: DB_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "db-user-creds" "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-user-creds" "key" "password") | indent 10 }}
         - name: HTTP_USER
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "http-user-creds" "key" "login") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "http-user-creds" "key" "login") | indent 10 }}
         - name: HTTP_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "http-user-creds" "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "http-user-creds" "key" "password") | indent 10 }}
         - name: HTTP_ADMIN_USER
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "admin-creds" "key" "login") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "admin-creds" "key" "login") | indent 10 }}
         - name: HTTP_ADMIN_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "admin-creds" "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "admin-creds" "key" "password") | indent 10 }}
         - name: HTTP_NODE_USER
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "node-creds" "key" "login") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "node-creds" "key" "login") | indent 10 }}
         - name: HTTP_NODE_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "node-creds" "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "node-creds" "key" "password") | indent 10 }}
         - name: REST_CONF_USER
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "restconf-creds" "key" "login") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restconf-creds" "key" "login") | indent 10 }}
         - name: REST_CONF_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "restconf-creds" "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restconf-creds" "key" "password") | indent 10 }}
         volumeMounts:
         - mountPath: /config-input
           name: config-input
diff --git a/kubernetes/common/dgbuilder/templates/secrets.yaml b/kubernetes/common/dgbuilder/templates/secrets.yaml
index c9a409fdca..4b4849980c 100644
--- a/kubernetes/common/dgbuilder/templates/secrets.yaml
+++ b/kubernetes/common/dgbuilder/templates/secrets.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright © 2018 AT&T, Amdocs, Bell Canada
 # Copyright © 2020 Samsung Electronics
 #
@@ -12,5 +13,6 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
 
-{{ include "common.secret" . }}
+{{ include "common.secretFast" . }}
diff --git a/kubernetes/common/dgbuilder/templates/service.yaml b/kubernetes/common/dgbuilder/templates/service.yaml
index 7a8f752a2d..bfe8b0aeb5 100644
--- a/kubernetes/common/dgbuilder/templates/service.yaml
+++ b/kubernetes/common/dgbuilder/templates/service.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright © 2018 AT&T, Amdocs, Bell Canada
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -11,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
 
 apiVersion: v1
 kind: Service
diff --git a/kubernetes/common/mariadb-galera/templates/backup/cronjob.yaml b/kubernetes/common/mariadb-galera/templates/backup/cronjob.yaml
index c9e2ffe85c..29d96748a3 100644
--- a/kubernetes/common/mariadb-galera/templates/backup/cronjob.yaml
+++ b/kubernetes/common/mariadb-galera/templates/backup/cronjob.yaml
@@ -86,7 +86,7 @@ spec:
               echo "Backup Successful!!!"
             env:
             - name: DB_PASS
-              {{- include "common.secret.envFromSecret" (dict "global" . "uid" (include "common.mariadb.secret.rootPassUID" .) "key" "password") | indent 14}}
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" (include "common.mariadb.secret.rootPassUID" .) "key" "password") | indent 14}}
             volumeMounts:
             - name: backup-dir
               mountPath: /backup
@@ -96,7 +96,7 @@ spec:
             imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
             env:
             - name: MYSQL_ROOT_PASSWORD
-              {{- include "common.secret.envFromSecret" (dict "global" . "uid" (include "common.mariadb.secret.rootPassUID" .) "key" "password") | indent 14}}
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" (include "common.mariadb.secret.rootPassUID" .) "key" "password") | indent 14}}
             command:
             - /bin/bash
             - -c
diff --git a/kubernetes/common/mariadb-galera/templates/configmap.yaml b/kubernetes/common/mariadb-galera/templates/configmap.yaml
index f143c3b679..e7bb701930 100644
--- a/kubernetes/common/mariadb-galera/templates/configmap.yaml
+++ b/kubernetes/common/mariadb-galera/templates/configmap.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright © 2018 Amdocs, Bell Canada
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -11,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
 
 {{- if .Values.externalConfig }}
 apiVersion: v1
diff --git a/kubernetes/common/mariadb-galera/templates/pv.yaml b/kubernetes/common/mariadb-galera/templates/pv.yaml
index 6e53a9543d..579b3475d1 100644
--- a/kubernetes/common/mariadb-galera/templates/pv.yaml
+++ b/kubernetes/common/mariadb-galera/templates/pv.yaml
@@ -13,6 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 */}}
+
 {{- $global := . }}
 {{- if and $global.Values.persistence.enabled (not $global.Values.persistence.existingClaim) }}
 {{- if eq "True" (include "common.needPV" .) -}}
diff --git a/kubernetes/common/mariadb-galera/templates/secrets.yaml b/kubernetes/common/mariadb-galera/templates/secrets.yaml
index 3f8eb0b6de..27c9a3aaee 100644
--- a/kubernetes/common/mariadb-galera/templates/secrets.yaml
+++ b/kubernetes/common/mariadb-galera/templates/secrets.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright © 2018 Amdocs, Bell Canada
 # Copyright © 2019 Samsung Electronics
 #
@@ -12,4 +13,6 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-{{ include "common.secret" . }}
+*/}}
+
+{{ include "common.secretFast" . }}
diff --git a/kubernetes/common/mariadb-galera/templates/service.yaml b/kubernetes/common/mariadb-galera/templates/service.yaml
index 71d1b0fe80..69d8999f67 100644
--- a/kubernetes/common/mariadb-galera/templates/service.yaml
+++ b/kubernetes/common/mariadb-galera/templates/service.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright © 2018 Amdocs, Bell Canada
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -11,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
 
 apiVersion: v1
 kind: Service
diff --git a/kubernetes/common/mariadb-galera/templates/statefulset.yaml b/kubernetes/common/mariadb-galera/templates/statefulset.yaml
index a6260fae54..7157e3390b 100644
--- a/kubernetes/common/mariadb-galera/templates/statefulset.yaml
+++ b/kubernetes/common/mariadb-galera/templates/statefulset.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright © 2019 Amdocs, Bell Canada, Orange, Samsung Electronics
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -11,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
 
 apiVersion: apps/v1beta1
 kind: StatefulSet
@@ -61,13 +63,13 @@ spec:
                   apiVersion: v1
                   fieldPath: metadata.namespace
             - name: MYSQL_USER
-              {{- include "common.secret.envFromSecret" (dict "global" . "uid" (include "common.mariadb.secret.userCredentialsUID" .) "key" "login") | indent 14}}
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" (include "common.mariadb.secret.userCredentialsUID" .) "key" "login") | indent 14}}
             - name: MYSQL_PASSWORD
-              {{- include "common.secret.envFromSecret" (dict "global" . "uid" (include "common.mariadb.secret.userCredentialsUID" .) "key" "password") | indent 14}}
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" (include "common.mariadb.secret.userCredentialsUID" .) "key" "password") | indent 14}}
             - name: MYSQL_DATABASE
               value: {{ default "" .Values.config.mysqlDatabase | quote }}
             - name: MYSQL_ROOT_PASSWORD
-              {{- include "common.secret.envFromSecret" (dict "global" . "uid" (include "common.mariadb.secret.rootPassUID" .) "key" "password") | indent 14}}
+              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" (include "common.mariadb.secret.rootPassUID" .) "key" "password") | indent 14}}
           ports:
           - containerPort: {{ .Values.service.internalPort }}
             name: {{ .Values.service.portName }}
diff --git a/kubernetes/common/network-name-gen/templates/deployment.yaml b/kubernetes/common/network-name-gen/templates/deployment.yaml
index a6d18e7a59..3e9e849052 100644
--- a/kubernetes/common/network-name-gen/templates/deployment.yaml
+++ b/kubernetes/common/network-name-gen/templates/deployment.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright (C) 2018  AT&T Intellectual Property.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -11,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
 
 apiVersion: extensions/v1beta1
 kind: Deployment
@@ -61,9 +63,9 @@ spec:
         - name: SPRING_PROFILE
           value: "{{ .Values.config.springProfile }}"
         - name: NENG_DB_USER
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "neng-db-secret" "key" "login") | indent 10}}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "neng-db-secret" "key" "login") | indent 10}}
         - name: NENG_DB_PASS
-          {{- include "common.secret.envFromSecret" (dict "global" . "uid" "neng-db-secret" "key" "password") | indent 10}}
+          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "neng-db-secret" "key" "password") | indent 10}}
         - name: NENG_DB_URL
           value: jdbc:mysql://{{ include "common.mariadbService" . }}:{{ include "common.mariadbPort" . }}/{{ index .Values "mariadb-galera" "config" "mysqlDatabase" }}
         - name: POL_CLIENT_AUTH
diff --git a/kubernetes/common/network-name-gen/templates/secrets.yaml b/kubernetes/common/network-name-gen/templates/secrets.yaml
index d5bdce3e04..61b83d7a9b 100644
--- a/kubernetes/common/network-name-gen/templates/secrets.yaml
+++ b/kubernetes/common/network-name-gen/templates/secrets.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright (c) 2018 Bell Canada
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -11,8 +12,9 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
 
-{{ include "common.secret" . }}
+{{ include "common.secretFast" . }}
 ---
 apiVersion: v1
 data:
diff --git a/kubernetes/common/network-name-gen/templates/service.yaml b/kubernetes/common/network-name-gen/templates/service.yaml
index a4c5b05012..753448c5b7 100644
--- a/kubernetes/common/network-name-gen/templates/service.yaml
+++ b/kubernetes/common/network-name-gen/templates/service.yaml
@@ -1,3 +1,4 @@
+{{/*
 # Copyright (C) 2018  AT&T Intellectual Property.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -11,6 +12,8 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+*/}}
+
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/kubernetes/common/postgres/templates/_deployment.tpl b/kubernetes/common/postgres/templates/_deployment.tpl
index 361e64847e..e3ac66933f 100644
--- a/kubernetes/common/postgres/templates/_deployment.tpl
+++ b/kubernetes/common/postgres/templates/_deployment.tpl
@@ -49,15 +49,15 @@ spec:
         - name: PG_PRIMARY_USER
           value: primaryuser
         - name: PG_PRIMARY_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" $dot "uid" (include "common.postgres.secret.primaryPasswordUID" .) "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" $dot "uid" (include "common.postgres.secret.primaryPasswordUID" .) "key" "password") | indent 10 }}
         - name: PG_USER
-          {{- include "common.secret.envFromSecret" (dict "global" $dot "uid" (include "common.postgres.secret.userCredentialsUID" .) "key" "login") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" $dot "uid" (include "common.postgres.secret.userCredentialsUID" .) "key" "login") | indent 10 }}
         - name: PG_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" $dot "uid" (include "common.postgres.secret.userCredentialsUID" .) "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" $dot "uid" (include "common.postgres.secret.userCredentialsUID" .) "key" "password") | indent 10 }}
         - name: PG_DATABASE
           value: "{{ $dot.Values.config.pgDatabase }}"
         - name: PG_ROOT_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" $dot "uid" (include "common.postgres.secret.rootPassUID" .) "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" $dot "uid" (include "common.postgres.secret.rootPassUID" .) "key" "password") | indent 10 }}
         volumeMounts:
         - mountPath: /config-input/setup.sql
           name: config
@@ -116,15 +116,15 @@ spec:
         - name: PG_PRIMARY_PORT
           value: "{{ $dot.Values.service.internalPort }}"
         - name: PG_PRIMARY_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" $dot "uid" (include "common.postgres.secret.primaryPasswordUID" .) "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" $dot "uid" (include "common.postgres.secret.primaryPasswordUID" .) "key" "password") | indent 10 }}
         - name: PG_USER
-          {{- include "common.secret.envFromSecret" (dict "global" $dot "uid" (include "common.postgres.secret.userCredentialsUID" .) "key" "login") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" $dot "uid" (include "common.postgres.secret.userCredentialsUID" .) "key" "login") | indent 10 }}
         - name: PG_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" $dot "uid" (include "common.postgres.secret.userCredentialsUID" .) "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" $dot "uid" (include "common.postgres.secret.userCredentialsUID" .) "key" "password") | indent 10 }}
         - name: PG_DATABASE
           value: "{{ $dot.Values.config.pgDatabase }}"
         - name: PG_ROOT_PASSWORD
-          {{- include "common.secret.envFromSecret" (dict "global" $dot "uid" (include "common.postgres.secret.rootPassUID" .) "key" "password") | indent 10 }}
+          {{- include "common.secret.envFromSecretFast" (dict "global" $dot "uid" (include "common.postgres.secret.rootPassUID" .) "key" "password") | indent 10 }}
         volumeMounts:
         - name: config
           mountPath: /pgconf/pool_hba.conf
diff --git a/kubernetes/common/postgres/templates/secrets.yaml b/kubernetes/common/postgres/templates/secrets.yaml
index 4c68015528..c4cde05216 100644
--- a/kubernetes/common/postgres/templates/secrets.yaml
+++ b/kubernetes/common/postgres/templates/secrets.yaml
@@ -13,4 +13,4 @@
 # # See the License for the specific language governing permissions and
 # # limitations under the License.
 */}}
-{{ include "common.secret" . }}
+{{ include "common.secretFast" . }}
-- 
cgit 1.2.3-korg