diff --git a/docker/heat/heat-api/Dockerfile b/docker/heat/heat-api/Dockerfile
index 44ff6ed93e..2bb25e45e4 100644
--- a/docker/heat/heat-api/Dockerfile
+++ b/docker/heat/heat-api/Dockerfile
@@ -1,14 +1,14 @@
-FROM kollaglue/fedora-rdo-base
-MAINTAINER James Labocki <jlabocki@redhat.com>
+FROM kollaglue/fedora-rdo-heat-base
+MAINTAINER Jeff Peeler <jpeeler@redhat.com>
 
-RUN yum install -y openstack-heat-api \
-	openstack-heat-api-cfn \
-	openstack-heat-common \
-	openstack-heat-api-cloudwatch \
-	openstack-utils \
-	python-openstackclient \
-	&& yum clean all
+# TODO: configure cfn and cloudwatch
+# TODO: remove python-openstackclient once crux feature is added in start.sh
+RUN yum -y install \
+    openstack-heat-api \
+    python-openstackclient \
+    ; yum clean all
 
 ADD ./start.sh /start.sh
+ADD ./check.sh /check.sh
 
 CMD ["/start.sh"]
diff --git a/docker/heat/heat-api/check.sh b/docker/heat/heat-api/check.sh
new file mode 100755
index 0000000000..eab8ee59ba
--- /dev/null
+++ b/docker/heat/heat-api/check.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+RES=0
+
+. /openrc
+if ! keystone token-get > /dev/null; then
+    echo "ERROR: keystone token-get failed" >&2
+    RES=1
+else
+    if ! heat stack-list > /dev/null; then
+        echo "ERROR: heat stack-list failed" >&2
+        RES=1
+    fi
+fi
+
+exit $RES
diff --git a/docker/heat/heat-api/start.sh b/docker/heat/heat-api/start.sh
old mode 100644
new mode 100755
index 8f73ae3e27..b6565c207c
--- a/docker/heat/heat-api/start.sh
+++ b/docker/heat/heat-api/start.sh
@@ -1,13 +1,34 @@
 #!/bin/bash
 set -e
 
-: ${IP_ADDRESS:=$IP_ADDRESS}
+. /opt/kolla/kolla-common.sh
+. /opt/kolla/config-heat.sh
 
-if [ -z "$IP_ADDRESS" ]; then
-	echo >&2 'error: IP_ADDRESS is not set.'
-	echo >&2 '   Be sure to set IP_ADDRESS so it can be placed in heat configurations'
-	exit 1
-fi
+check_required_vars KEYSTONE_ADMIN_TOKEN KEYSTONE_ADMIN_SERVICE_HOST \
+                    HEAT_KEYSTONE_USER HEAT_KEYSTONE_PASSWORD \
+                    KEYSTONE_AUTH_PROTOCOL ADMIN_TENANT_NAME \
+                    HEAT_API_SERVICE_HOST PUBLIC_IP
 
+check_for_keystone
+
+export SERVICE_TOKEN="${KEYSTONE_ADMIN_TOKEN}"
+export SERVICE_ENDPOINT="${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_ADMIN_SERVICE_HOST}:35357/v2.0"
+crux user-create -n ${HEAT_KEYSTONE_USER} \
+    -p ${HEAT_KEYSTONE_PASSWORD} \
+    -t ${ADMIN_TENANT_NAME} \
+    -r admin
+
+crux endpoint-create --remove-all -n ${HEAT_KEYSTONE_USER} -t orchestration \
+    -I "${KEYSTONE_AUTH_PROTOCOL}://${HEAT_API_SERVICE_HOST}:8004/v1/%(tenant_id)s" \
+    -P "${KEYSTONE_AUTH_PROTOCOL}://${PUBLIC_IP}:8004/v1/%(tenant_id)s" \
+    -A "${KEYSTONE_AUTH_PROTOCOL}://${HEAT_API_SERVICE_HOST}:8004/v1/%(tenant_id)s"
+
+#crux endpoint-create --remove-all -n ${HEAT_KEYSTONE_USER} -t cloudformation \
+#    -I "http://${HEAT_CFN_API_SERVICE_HOST}:8000/v1" \
+#    -P "http://${PUBLIC_IP}:8000/v1" \
+#    -A "http://${HEAT_CFN_API_SERVICE_HOST}:8000/v1"
+
+# will use crux after https://github.com/larsks/crux/issues/1 is implemented
+openstack role list --os-token="${KEYSTONE_ADMIN_TOKEN}" --os-url $SERVICE_ENDPOINT -f csv | tail -n +2 | awk -F, '{print $2}' | grep heat_stack_user || keystone role-create --name heat_stack_user
 
 exec /usr/bin/heat-api
diff --git a/docker/heat/heat-base/Dockerfile b/docker/heat/heat-base/Dockerfile
index 1904d189c6..1bc0c6c8ec 100644
--- a/docker/heat/heat-base/Dockerfile
+++ b/docker/heat/heat-base/Dockerfile
@@ -1,10 +1,5 @@
-FROM fedora-rdo-base
-MAINTAINER Steven Dake <sdake@redhat.com>
+FROM kollaglue/fedora-rdo-base
+MAINTAINER Jeff Peeler <jpeeler@redhat.com>
 
-RUN yum -y install \
-	openstack-utils \
-	openstack-heat && yum clean all
-
-# These will come after we sort out start time config
-#RUN mkdir /opt/heat
-#COPY config-heat.sh /opt/heat/config-heat.sh
+RUN mkdir -p /opt/kolla
+COPY config-heat.sh /opt/kolla/config-heat.sh
diff --git a/docker/heat/heat-base/config-heat.sh b/docker/heat/heat-base/config-heat.sh
new file mode 100755
index 0000000000..c2837325c2
--- /dev/null
+++ b/docker/heat/heat-base/config-heat.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+
+set -e
+
+. /opt/kolla/kolla-common.sh
+
+: ${ADMIN_TENANT_NAME:=admin}
+: ${HEAT_DB_NAME:=heat}
+: ${HEAT_DB_USER:=heat}
+: ${HEAT_KEYSTONE_USER:=heat}
+: ${KEYSTONE_AUTH_PROTOCOL:=http}
+: ${PUBLIC_IP:=$HEAT_API_PORT_8004_TCP_ADDR}
+: ${RABBIT_USER:=guest}
+: ${RABBIT_PASSWORD:=guest}
+
+check_required_vars HEAT_DB_PASSWORD HEAT_KEYSTONE_PASSWORD
+dump_vars
+
+cat > /openrc <<EOF
+export OS_AUTH_URL="http://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/v2.0"
+export OS_USERNAME="${HEAT_KEYSTONE_USER}"
+export OS_PASSWORD="${HEAT_KEYSTONE_PASSWORD}"
+export OS_TENANT_NAME="${ADMIN_TENANT_NAME}"
+EOF
+
+crudini --set /etc/heat/heat.conf DEFAULT log_file \
+    ""
+crudini --set /etc/heat/heat.conf DEFAULT use_stderr \
+    true
+crudini --set /etc/heat/heat.conf DEFAULT rpc_backend \
+    heat.openstack.common.rpc.impl_kombu
+crudini --set /etc/heat/heat.conf DEFAULT rabbit_host \
+    ${RABBITMQ_SERVICE_HOST}
+crudini --set /etc/heat/heat.conf DEFAULT rabbit_userid \
+    ${RABBIT_USER}
+crudini --set /etc/heat/heat.conf DEFAULT rabbit_password \
+    ${RABBIT_PASSWORD}
+
+crudini --set /etc/heat/heat.conf database connection \
+    mysql://${HEAT_DB_USER}:${HEAT_DB_PASSWORD}@${MARIADB_SERVICE_HOST}/${HEAT_DB_NAME}
+
+crudini --set /etc/heat/heat.conf keystone_authtoken auth_protocol \
+    "${KEYSTONE_AUTH_PROTOCOL}"
+crudini --set /etc/heat/heat.conf keystone_authtoken auth_host \
+    "${KEYSTONE_PUBLIC_SERVICE_HOST}"
+crudini --set /etc/heat/heat.conf keystone_authtoken auth_port \
+    5000
+crudini --set /etc/heat/heat.conf keystone_authtoken auth_uri \
+    "${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/v2.0"
+crudini --set /etc/heat/heat.conf  keystone_authtoken admin_tenant_name \
+    "${ADMIN_TENANT_NAME}"
+crudini --set /etc/heat/heat.conf keystone_authtoken admin_user \
+    "${HEAT_KEYSTONE_USER}"
+crudini --set /etc/heat/heat.conf keystone_authtoken admin_password \
+    "${HEAT_KEYSTONE_PASSWORD}"
+
+crudini --set /etc/heat/heat.conf ec2authtoken auth_uri \
+    "${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/v2.0"
+
+# cfn
+#crudini --set /etc/heat/heat.conf DEFAULT heat_metadata_server_url \
+#    http://${HEAT_CFN_API_SERVICE_HOST}:8000
+#crudini --set /etc/heat/heat.conf DEFAULT heat_waitcondition_server_url \
+#    http://${HEAT_CFN_API_SERVICE_HOST}:8000/v1/waitcondition
+
diff --git a/docker/heat/heat-engine/Dockerfile b/docker/heat/heat-engine/Dockerfile
index 49b80e1f66..163e97a2db 100644
--- a/docker/heat/heat-engine/Dockerfile
+++ b/docker/heat/heat-engine/Dockerfile
@@ -1,6 +1,9 @@
-FROM fedora-rdo-base
-MAINTAINER Steven Dake <sdake@redhat.com>
+FROM kollaglue/fedora-rdo-heat-base
+MAINTAINER Jeff Peeler <jpeeler@redhat.com>
+
+RUN yum -y install \
+    openstack-heat-engine \
+    ; yum clean all
 
 ADD ./start.sh /start.sh
 CMD ["/start.sh"]
-
diff --git a/docker/heat/heat-engine/start.sh b/docker/heat/heat-engine/start.sh
old mode 100644
new mode 100755
index 306cbbacef..0ab9e48005
--- a/docker/heat/heat-engine/start.sh
+++ b/docker/heat/heat-engine/start.sh
@@ -1,40 +1,18 @@
 #!/bin/sh
 
-: ${GLANCE_DB_USER:=heat}
-: ${GLANCE_DB_NAME:=heat}
-: ${KEYSTONE_AUTH_PROTOCOL:=http}
-: ${GLANCE_KEYSTONE_USER:=heat}
-: ${ADMIN_TENANT_NAME:=admin}
+. /opt/kolla/kolla-common.sh
+. /opt/kolla/config-heat.sh
 
-if ! [ "$KEYSTONE_ADMIN_TOKEN" ]; then
-	echo "*** Missing KEYSTONE_ADMIN_TOKEN" >&2
-	exit 1
-fi
+check_required_vars MARIADB_SERVICE_HOST DB_ROOT_PASSWORD \
+                    HEAT_DB_NAME HEAT_DB_USER HEAT_DB_PASSWORD
+check_for_db
 
-if ! [ "$DB_ROOT_PASSWORD" ]; then
-	echo "*** Missing DB_ROOT_PASSWORD" >&2
-	exit 1
-fi
-
-if ! [ "$GLANCE_DB_PASSWORD" ]; then
-	GLANCE_DB_PASSWORD=$(openssl rand -hex 15)
-	export GLANCE_DB_PASSWORD
-fi
-
-sh /opt/heat/config-heat.sh engine
-
-mysql -h ${MARIADB_PORT_3306_TCP_ADDR} -u root \
-	-p${DB_ROOT_PASSWORD} mysql <<EOF
-CREATE DATABASE IF NOT EXISTS ${GLANCE_DB_NAME};
-GRANT ALL PRIVILEGES ON heat* TO
-	'${GLANCE_DB_USER}'@'%' IDENTIFIED BY '${GLANCE_DB_PASSWORD}'
+mysql -h ${MARIADB_SERVICE_HOST} -u root -p${DB_ROOT_PASSWORD} mysql <<EOF
+CREATE DATABASE IF NOT EXISTS ${HEAT_DB_NAME} DEFAULT CHARACTER SET utf8;
+GRANT ALL PRIVILEGES ON ${HEAT_DB_NAME}.* TO
+    '${HEAT_DB_USER}'@'%' IDENTIFIED BY '${HEAT_DB_PASSWORD}'
 EOF
 
-export SERVICE_TOKEN="${KEYSTONE_ADMIN_TOKEN}"
-export SERVICE_ENDPOINT="${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_ADMIN_PORT_35357_TCP_ADDR}:35357/v2.0"
-
-/bin/keystone user-create --name ${GLANCE_KEYSTONE_USER} --pass ${GLANCE_ADMIN_PASSWORD}
-/bin/keystone role-create --name ${GLANCE_KEYSTONE_USER}
-/bin/keystone user-role-add --user ${GLANCE_KEYSTONE_USER} --role admin --tenant ${ADMIN_TENANT_NAME}
+/usr/bin/heat-manage db_sync
 
 exec /usr/bin/heat-engine
diff --git a/k8s/pod/heat-pod.yaml b/k8s/pod/heat-pod.yaml
index 9d6d17d801..a4eb0de57e 100644
--- a/k8s/pod/heat-pod.yaml
+++ b/k8s/pod/heat-pod.yaml
@@ -5,26 +5,26 @@ desiredState:
       - name: DB_ROOT_PASSWORD
         value: password
       - name: HEAT_DB_PASSWORD
-        value: heatdbpassword
-      - name: KEYSTONE_ADMIN_TOKEN
-        value: ADMINTOKEN
-      image: fedora-rdo-heat-engine
+        value: password
+      - name: HEAT_KEYSTONE_PASSWORD
+        value: password
+      image: kollaglue/fedora-rdo-heat-engine
       name: heat-engine
-      ports:
-      - containerPort: 9292
     - env:
       - name: DB_ROOT_PASSWORD
         value: password
       - name: HEAT_DB_PASSWORD
-        value: heatdbpassword
+        value: password
+      - name: HEAT_KEYSTONE_PASSWORD
+        value: password
       - name: KEYSTONE_ADMIN_TOKEN
         value: ADMINTOKEN
-      image: fedora-rdo-heat-api
+      image: kollaglue/fedora-rdo-heat-api
       name: heat-api
       ports:
-      - containerPort: 9292
+      - containerPort: 8004
     id: heat-1
     version: v1beta1
 id: heat
 labels:
-  name: keystone-master
+  name: heat
diff --git a/k8s/service/heat-api-service.yaml b/k8s/service/heat-api-service.yaml
new file mode 100644
index 0000000000..875d8ded80
--- /dev/null
+++ b/k8s/service/heat-api-service.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1beta1
+containerPort: 8004
+id: heat-api
+kind: Service
+port: 8004
+selector:
+  name: heat