diff --git a/deployment.yaml b/deployment.yaml
new file mode 100644
index 0000000..5cc038b
--- /dev/null
+++ b/deployment.yaml
@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netdata-parent
+  labels:
+    app: netdata
+    role: parent
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: netdata
+      role: parent
+  template:
+    metadata:
+      labels:
+        app: netdata
+        role: parent
+    spec:
+      securityContext:
+        fsGroup: 201
+      serviceAccountName: netdata
+      containers:
+        - name: netdata
+          image: "netdata/netdata:edge"
+          imagePullPolicy: Always
+          env:
+            - name: NETDATA_CLAIM_URL
+              value: "https://api.netdata.cloud"
+            - name: NETDATA_CLAIM_TOKEN
+              value: "REDACTED"
+            - name: NETDATA_CLAIM_ROOMS
+              value: "REDACTED"
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: NETDATA_LISTENER_PORT
+              value: '19999'
+          ports:
+            - name: http
+              containerPort: 19999
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command: ["/usr/sbin/netdatacli", "ping"]
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
+          readinessProbe:
+            exec:
+              command: ["/usr/sbin/netdatacli", "ping"]
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
+          securityContext:
+            runAsUser: 201
+            runAsGroup: 201
+          volumeMounts:
+            - name: os-release
+              mountPath: /host/etc/os-release
+            - name: configmap
+              mountPath: /etc/netdata/health_alarm_notify.conf
+              subPath: health
+            - name: configmap
+              mountPath: /etc/netdata/netdata.conf
+              subPath: netdata
+            - name: configmap
+              mountPath: /etc/netdata/stream.conf
+              subPath: stream
+            - name: database
+              mountPath: /var/cache/netdata
+            - name: alarms
+              mountPath: /var/lib/netdata
+          resources: {}
+      terminationGracePeriodSeconds: 300
+      volumes:
+        - name: os-release
+          hostPath:
+            path: /etc/os-release
+        - name: configmap
+          configMap:
+            name: netdata-conf-parent
+            optional: true
+        - name: database
+          persistentVolumeClaim:
+            claimName: netdata-parent-database
+        - name: alarms
+          persistentVolumeClaim:
+            claimName: netdata-parent-alarms
+      dnsPolicy: Default
diff --git a/ingress.yaml b/ingress.yaml
new file mode 100644
index 0000000..1767b3a
--- /dev/null
+++ b/ingress.yaml
@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: netdata
+  labels:
+    app: netdata
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+spec:
+  rules:
+    - host: netdata.k8s.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: netdata
+                port:
+                  name: http
diff --git a/kustomization.yaml b/kustomization.yaml
new file mode 100644
index 0000000..16d3ab7
--- /dev/null
+++ b/kustomization.yaml
@@ -0,0 +1,51 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: netdata
+
+resources:
+  - namespace.yaml
+  - rbac.yaml
+  - child/daemonset.yaml
+  - k8s-state/deployment.yaml
+  - k8s-state/pvc.yaml
+  - parent/deployment.yaml
+  - parent/service.yaml
+  - parent/pvc.yaml
+  - parent/ingress.yaml
+
+# configMapGenerator content-hashes each ConfigMap's name (e.g. netdata-conf-child-a1b2c3d4).
+# Kustomize automatically rewrites every Deployment/DaemonSet reference to the new hashed
+# name whenever any file below changes. Since the pod template's volume spec then differs,
+# Kubernetes rolls the pods automatically on `kubectl apply` — no manual checksum bump,
+# no manual `rollout restart`, ever again.
+configMapGenerator:
+  - name: netdata-conf-child
+    files:
+      - go.d=child/conf/go.d.yaml
+      - kubelet=child/conf/kubelet.yaml
+      - kubeproxy=child/conf/kubeproxy.yaml
+      - web_log=child/conf/web_log.yaml
+      - netdata=child/conf/netdata.conf
+      - stream=child/conf/stream.conf
+      - otel=child/conf/otel.yaml
+
+  - name: netdata-child-sd-config-map
+    files:
+      - config.yml=child/conf/sd-config.yml
+
+  - name: netdata-conf-k8s-state
+    files:
+      - go.d=k8s-state/conf/go.d.yaml
+      - go.d-k8s_state=k8s-state/conf/go.d-k8s_state.yaml
+      - netdata=k8s-state/conf/netdata.conf
+      - stream=k8s-state/conf/stream.conf
+      - httpcheck=k8s-state/conf/httpcheck.yaml
+      - dnsquery=k8s-state/conf/dnsquery.yaml
+      - x509check=k8s-state/conf/x509check.yaml
+
+  - name: netdata-conf-parent
+    files:
+      - health=parent/conf/health.conf
+      - netdata=parent/conf/netdata.conf
+      - stream=parent/conf/stream.conf
diff --git a/namespace.yaml b/namespace.yaml
new file mode 100644
index 0000000..e5724c0
--- /dev/null
+++ b/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netdata
diff --git a/rbac.yaml b/rbac.yaml
new file mode 100644
index 0000000..4adbeb4
--- /dev/null
+++ b/rbac.yaml
@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: netdata
+  labels:
+    app: netdata
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: netdata
+  labels:
+    app: netdata
+rules:
+  - apiGroups: [""]
+    resources:
+      - "pods"
+      - "services"
+      - "configmaps"
+      - "secrets"
+      - "nodes"
+      - "nodes/metrics"
+      - "nodes/proxy"
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["cronjobs", "jobs"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: netdata
+  labels:
+    app: netdata
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: netdata
+subjects:
+  - kind: ServiceAccount
+    name: netdata
+    namespace: netdata