diff --git a/kubernetes/11-storage.yml b/kubernetes/11-storage.yml
index db01c10..47b32ca 100644
--- a/kubernetes/11-storage.yml
+++ b/kubernetes/11-storage.yml
@@ -1,141 +1,218 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: storage
 data:
   config.yml: |
     storage:
       cls: local
-      db: postgresql:///?service=swh-storage
+      db: postgresql:///?service=swh
       objstorage:
         cls: remote
         url: http://objstorage:5003/
       journal_writer:
         cls: kafka
         args:
           brokers:
             - kafka
           prefix: swh.journal.objects
           client_id: swh.storage.master
+  entrypoint-init-db.sh: |
+    #!/bin/bash
+
+    set -e
+
+    echo -n "waiting for database availability"
+    set +e
+    ko=1
+    while [[ $ko -gt 0 ]]; do PGCONNECT_TIMEOUT=2 psql --list &>/dev/null;ko=$?; echo -n .; sleep 0.5; done
+    echo
+    set -e
+
+    echo Init swh-storage database
+
+    echo Creating extensions...
+    swh db init-admin --db-name ${PGDATABASE} storage
+
+    echo Initializing the database...
+    swh db init --db-name ${PGDATABASE} storage
+
   entrypoint.sh: |
     #!/bin/bash
 
     set -e
 
+    echo "${PGHOST}:5432:${PGDATABASE}:${PGUSER}:${PGPASSWORD}" >> ~/.pgpass
+    cat >> ~/.pg_service.conf <<EOF
+    [${PGDATABASE}]
+    dbname=${PGDATABASE}
+    host=${PGHOST}
+    port=5432
+    user=${PGUSER}
+    EOF
+
     echo Starting the swh-storage API server
     exec gunicorn --bind 0.0.0.0:5002 \
           --reload \
           --threads 4 \
           --workers 2 \
           --log-level DEBUG \
           --timeout 3600 \
           --config 'python:swh.core.api.gunicorn_config' \
           'swh.storage.api.server:make_app_from_configfile()'
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: storage
   labels:
     app: storage
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: storage
   strategy:
     type: RollingUpdate
     rollingUpdate:
       maxSurge: 1
   template:
     metadata:
       labels:
         app: storage
     spec:
+      initContainers:
+        - name: storage-init
+          image: swh/storage:latest
+          imagePullPolicy: Always
+          command: 
+            - /entrypoint.sh
+          env:
+          - name: POSTGRES_PASSWORD_FILE
+            value: "/run/secrets/postgres-password"
+          - name: PGHOST
+            value: "storage-db"
+          - name: PGUSER
+            valueFrom:
+              configMapKeyRef:
+                name: storage-db
+                key: POSTGRES_USER
+          - name: PGPASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: storage-db
+                key: POSTGRES_PASSWORD
+          - name: PGDATABASE
+            valueFrom:
+              configMapKeyRef:
+                name: storage-db
+                key: POSTGRES_DB
+          - name: SWH_CONFIG_FILENAME
+            value: /etc/softwareheritage/config.yml
+          volumeMounts:
+            - name: db-password
+              mountPath: /run/secrets/postgres-password
+              subPath: POSTGRES_PASSWORD
+              readOnly: true
+            - name: config
+              mountPath: /etc/softwareheritage/config.yml
+              subPath: config.yml
+              readOnly: true
+            - name: config
+              mountPath: /entrypoint.sh
+              subPath: entrypoint-init-db.sh
+              readOnly: true
       containers:
       - name: storage
         image: swh/storage:latest
         imagePullPolicy: Always
         command: 
           - /entrypoint.sh
         ports:
         - containerPort: 5002
         env:
         - name: PORT
           value: "5002"
         - name: STATSD_HOST
           value: "prometheus-statsd-exporter"
         - name: STATSD_PORT
           value: "9125"
         - name: POSTGRES_PASSWORD_FILE
-          value: "/etc/softwareheritage/db-password"
+          value: "/run/secrets/postgres-password"
         - name: PGHOST
           value: "storage-db"
         - name: PGUSER
           valueFrom:
             configMapKeyRef:
               name: storage-db
               key: POSTGRES_USER
-        - name: POSTGRES_PASSWORD
+        - name: PGPASSWORD
           valueFrom:
             secretKeyRef:
               name: storage-db
               key: POSTGRES_PASSWORD
-        - name: POSTGRES_DB
+        - name: PGDATABASE
           valueFrom:
             configMapKeyRef:
               name: storage-db
               key: POSTGRES_DB
         - name: SWH_CONFIG_FILENAME
           value: /etc/softwareheritage/config.yml
         volumeMounts:
           - name: db-password
             mountPath: /run/secrets/postgres-password
             subPath: POSTGRES_PASSWORD
             readOnly: true
           - name: config
             mountPath: /etc/softwareheritage/config.yml
             subPath: config.yml
             readOnly: true
           - name: config
             mountPath: /entrypoint.sh
             subPath: entrypoint.sh
             readOnly: true
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "250m"
+          limits:
+            memory: "1024Mi"
+            cpu: "500m"
       volumes:
         - name: config
           configMap:
             name: storage
             defaultMode: 0777
         - name: db-password
           secret:
             secretName: storage-db
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: storage
 spec:
   type: ClusterIP
   selector:
     app: storage
   ports:
     - port: 5002
       targetPort: 5002
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: storage
 spec:
   rules:
   - host: storage.default
     http:
       paths:
       - path: /
         pathType: Prefix
         backend:
           service:
             name: storage
             port: 
               number: 5002