diff --git a/voltha-infra/Chart.yaml b/voltha-infra/Chart.yaml
index 1874c92..526483b 100644
--- a/voltha-infra/Chart.yaml
+++ b/voltha-infra/Chart.yaml
@@ -29,7 +29,7 @@
 name: voltha-infra
 
 appVersion: "1.0"
-version: 0.1.11
+version: 0.1.12
 
 dependencies:
   - name: onos-classic
diff --git a/voltha-infra/templates/clusterrole.yaml b/voltha-infra/templates/clusterrole.yaml
new file mode 100644
index 0000000..504fafc
--- /dev/null
+++ b/voltha-infra/templates/clusterrole.yaml
@@ -0,0 +1,23 @@
+# Copyright 2020-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+apiVersion: "rbac.authorization.k8s.io/v1"
+kind: "ClusterRole"
+metadata:
+  name: "{{ .Release.Name }}-onos-config-loader-pod-reader"
+  namespace: {{ .Release.Namespace | quote }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
diff --git a/voltha-infra/templates/clusterrolebinding.yaml b/voltha-infra/templates/clusterrolebinding.yaml
new file mode 100644
index 0000000..5ddc9c1
--- /dev/null
+++ b/voltha-infra/templates/clusterrolebinding.yaml
@@ -0,0 +1,27 @@
+# Copyright 2020-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+apiVersion: "rbac.authorization.k8s.io/v1"
+kind: "ClusterRoleBinding"
+metadata:
+  name: "{{ .Release.Name }}-onos-config-loader-pod-reader"
+  namespace: {{ .Release.Namespace | quote }}
+subjects:
+  - kind: "ServiceAccount"
+    name: "{{ .Release.Name }}-onos-config-loader-service-account"
+    namespace: {{ .Release.Namespace | quote }}
+roleRef:
+    kind: "ClusterRole"
+    name: "{{ .Release.Name }}-onos-config-loader-pod-reader"
+    apiGroup: "rbac.authorization.k8s.io"
diff --git a/voltha-infra/templates/onos-config-loader-script.yaml b/voltha-infra/templates/onos-config-loader-script.yaml
index 8ca2480..6491ab7 100644
--- a/voltha-infra/templates/onos-config-loader-script.yaml
+++ b/voltha-infra/templates/onos-config-loader-script.yaml
@@ -21,6 +21,26 @@
   loader.sh: >
     set -euo pipefail
 
+    # onos-config-loader most likely start before ONOS is deployed, so check for ONOS before waiting for it to be ready
+
+    has_onos=$(kubectl get pods -l app=onos-classic --all-namespaces | wc -l);
+
+    while [[ $has_onos == 0 ]]; do
+      echo -e "Waiting for ONOS to be deployed";
+      sleep 5;
+      has_onos=$(kubectl get pods -l app=onos-classic --all-namespaces | wc -l);
+    done
+
+    # wait all ONOS pods to be ready
+
+    onos_starting=$(kubectl get pods -l app=onos-classic --all-namespaces --field-selector=status.phase!=Running | wc -l);
+
+    while [[ $onos_starting != 0 ]]; do
+      echo -e "$onos_starting ONOS instances are still starting...";
+      sleep 5;
+      onos_starting=$(kubectl get pods --all-namespaces -l app=onos-classic | grep "0/" | wc -l);
+    done
+
     # a POST to a non ready netcfg return 207 in case of failure, while a GET returns 404,
     # check the apps key is ready to accept data before sending them
 
diff --git a/voltha-infra/templates/onos-config-loader.yaml b/voltha-infra/templates/onos-config-loader.yaml
index 79fc6a1..f018eeb 100644
--- a/voltha-infra/templates/onos-config-loader.yaml
+++ b/voltha-infra/templates/onos-config-loader.yaml
@@ -33,18 +33,21 @@
         checksum/config: {{ include (print $.Template.BasePath "/onos-config-loader-configmap.yaml") . | sha256sum }}
     spec:
       restartPolicy: OnFailure
+      serviceAccountName: "{{ .Release.Name }}-onos-config-loader-service-account"
       containers:
         - name: onos-config-loader
-          image: ellerbrock/alpine-bash-curl-ssl:latest
-          imagePullPolicy: IfNotPresent
+          image: voltha/voltha-ci-tools:2.3.2-onos-config-loader
+          imagePullPolicy: Always
           command:
-            - "bash"
+            - "/bin/bash"
             - "/opt/loader/loader.sh"
           volumeMounts:
             - name: onos-configs
               mountPath: /opt/configs
             - name: onos-loader
               mountPath: /opt/loader
+            - name: kube-config-volume
+              mountPath: /etc/kube
       volumes:
         - name: onos-configs
           configMap:
@@ -53,3 +56,8 @@
           configMap:
             name: {{ .Release.Name }}-onos-configs-loader
             defaultMode: 0777
+        - name: kube-config-volume
+          configMap:
+            # Provide the name of the ConfigMap containing the files you want
+            # to add to the container
+            name: kube-config
diff --git a/voltha-infra/templates/serviceaccount.yaml b/voltha-infra/templates/serviceaccount.yaml
new file mode 100644
index 0000000..6cba9a8
--- /dev/null
+++ b/voltha-infra/templates/serviceaccount.yaml
@@ -0,0 +1,19 @@
+# Copyright 2020-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+apiVersion: "v1"
+kind: "ServiceAccount"
+metadata:
+  name: "{{ .Release.Name }}-onos-config-loader-service-account"
+  namespace: {{ .Release.Namespace | quote }}