diff --git a/.github/workflows/actions/project-cache/action.yml b/.github/workflows/actions/project-cache/action.yml
deleted file mode 100644
index a9af171e..00000000
--- a/.github/workflows/actions/project-cache/action.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: 'Project Cache'
-description: 'Cache rust packages and target directory'
-
-inputs:
-  target-dir:
-    required: true
-    description: "Project target directory"
-    default: target
-
-runs:
-  using: "composite"
-  steps:
-    - uses: actions/cache@v3
-      with:
-        path: |
-          ~/.cargo/bin/
-          ~/.cargo/registry/index/
-          ~/.cargo/registry/cache/
-          ~/.cargo/git/db/
-          ${{ inputs.target-dir }}
-        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 00000000..f7aa5c6e
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,45 @@
+name: "Docker Automation"
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docker_push:
+    runs-on: ubuntu-latest
+
+    env:
+      FORCE_COLOR: 1
+
+    concurrency:
+      group: ${{ github.ref }}
+      cancel-in-progress: true
+
+    steps:
+      - uses: earthly/actions-setup@v1
+        with:
+          version: v0.8.0
+
+      - uses: actions/checkout@v4
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: cypherkitty
+          password: ${{ secrets.META_SECRET_GH_PAT }}
+
+      - name: run tests
+        run: |
+          earthly \
+            --allow-privileged \
+            --ci \
+            --remote-cache=ghcr.io/meta-secret/core:cache \
+            --push \
+            ./meta-secret+build-meta-server-image
diff --git a/infra/Earthfile b/infra/Earthfile
index d51fee97..246ce05f 100644
--- a/infra/Earthfile
+++ b/infra/Earthfile
@@ -1,5 +1,8 @@
 VERSION 0.8
 FROM scratch
 
-sub-sub:
-    FROM ubuntu:latest
+kcl-config-gen:
+    FROM --platform=linux/amd64 kcllang/kcl:v0.11.0
+    RUN --no-cache kcl
+
+
diff --git a/infra/k8s/meta-secret-server/common.k b/infra/k8s/meta-secret-server/common.k
new file mode 100644
index 00000000..0b6537c6
--- /dev/null
+++ b/infra/k8s/meta-secret-server/common.k
@@ -0,0 +1,12 @@
+schema Metadata:
+    name: str
+    labels: Labels
+
+schema Labels:
+    type: str
+    location: str
+
+
+projectName = "meta-secret-server"
+volumeName = "${projectName}-vol"
+appPath = "/meta-secret/app/meta-server"
diff --git a/infra/k8s/meta-secret-server/kcl.mod b/infra/k8s/meta-secret-server/kcl.mod
new file mode 100644
index 00000000..66a97731
--- /dev/null
+++ b/infra/k8s/meta-secret-server/kcl.mod
@@ -0,0 +1,5 @@
+[package]
+name = "meta-secret-server"
+edition = "v0.8.0"
+version = "0.0.1"
+
diff --git a/infra/k8s/meta-secret-server/statefulset.k b/infra/k8s/meta-secret-server/statefulset.k
new file mode 100644
index 00000000..8ac912c6
--- /dev/null
+++ b/infra/k8s/meta-secret-server/statefulset.k
@@ -0,0 +1,50 @@
+import .common
+
+apiVersion = "apps/v1"
+kind = "StatefulSet"
+
+metadata = {
+    name = common.projectName
+}
+
+spec = {
+    replicas = 1
+    serviceName = common.projectName
+    selector = {
+        matchLabels = {
+            app = common.projectName
+        }
+    }
+    template = {
+        metadata = {
+            labels = {
+                app = common.projectName
+            }
+        }
+        spec = {
+            containers = [
+                {
+                    name = common.projectName
+                    imagePullPolicy = "Always"
+                    image = option("imageName")
+                    command = ["/bin/sh", "-c", "./meta-server"]
+                    volumeMounts = [
+                        {
+                            name = "config"
+                            mountPath = "${common.appPath}/config.yaml"
+                            subPath = "config.yaml"
+                        }
+                    ]
+                }
+            ]
+            volumes = [
+                {
+                    name = "config"
+                    configMap = {
+                        name = "${common.projectName}-config"
+                    }
+                }
+            ]
+        }
+    }
+}
diff --git a/meta-secret/Earthfile b/meta-secret/Earthfile
index 98c97490..d502c0e9 100644
--- a/meta-secret/Earthfile
+++ b/meta-secret/Earthfile
@@ -42,7 +42,7 @@ build-meta-server-image:
     WORKDIR /app
     COPY +meta-server-builder/target/release/meta-server .
     CMD ./meta-server
-    SAVE IMAGE meta-secret-server:latest
+    SAVE IMAGE --push meta-secret-server:latest
 
 wasm-build:
     FROM +builder