diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
new file mode 100644
index 0000000..1a1a61e
--- /dev/null
+++ b/k8s/deployment.yaml
@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: datalab-lite
+  namespace: datalab-lite
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: datalab-lite
+  template:
+    metadata:
+      labels:
+        app: datalab-lite
+    spec:
+      serviceAccountName: datalab-lite-sa
+      initContainers:
+      - name: install-deps
+        image: python:3.11-slim
+        command:
+        - pip
+        - install
+        - --target=/app/deps
+        - fastapi
+        - uvicorn
+        - httpx
+        - python-jose[cryptography]
+        - kubernetes
+        - minio
+        - python-multipart
+        - jinja2
+        - requests
+        volumeMounts:
+        - mountPath: /app/deps
+          name: deps
+      containers:
+      - name: datalab-lite
+        image: python:3.11-slim
+        command:
+        - sh
+        - -c
+        - python3 -c "import urllib.request; urllib.request.urlretrieve('https://dl.min.io/client/mc/release/linux-amd64/mc', '/usr/local/bin/mc')" && chmod +x /usr/local/bin/mc && mc alias set minio-local https://minio.lab.leadwire.dev admin Minio@Leadwire2026! --insecure && python -m uvicorn main:app --host 0.0.0.0 --port 8000
+        env:
+        - name: PYTHONPATH
+          value: /app/deps
+        - name: CLIENT_SECRET
+          value: ""
+        ports:
+        - containerPort: 8000
+        workingDir: /app/code
+        volumeMounts:
+        - mountPath: /app/code
+          name: code
+        - mountPath: /app/deps
+          name: deps
+        - mountPath: /app/code/templates
+          name: templates
+      volumes:
+      - name: code
+        configMap:
+          name: datalab-lite-code
+      - name: deps
+        emptyDir: {}
+      - name: templates
+        configMap:
+          name: datalab-lite-templates
diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml
new file mode 100644
index 0000000..e40204a
--- /dev/null
+++ b/k8s/ingress.yaml
@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: datalab-lite
+  namespace: datalab-lite
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: datalablite.lab.leadwire.dev
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: datalab-lite
+            port:
+              number: 8000
+  tls:
+  - hosts:
+    - datalablite.lab.leadwire.dev
+    secretName: datalab-lite-tls
diff --git a/k8s/service.yaml b/k8s/service.yaml
new file mode 100644
index 0000000..ad7e9f2
--- /dev/null
+++ b/k8s/service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: datalab-lite
+  namespace: datalab-lite
+spec:
+  selector:
+    app: datalab-lite
+  ports:
+  - port: 8000
+    targetPort: 8000
+  type: ClusterIP