diff --git a/kubernetes/Makefile b/kubernetes/Makefile
new file mode 100644
index 0000000..614748b
--- /dev/null
+++ b/kubernetes/Makefile
@@ -0,0 +1,64 @@
+KUBE_DIR := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST)))))
+TOFU := $(KUBE_DIR)/tofu
+ANSIBLE := $(KUBE_DIR)/ansible
+SSH_KEY := $(KUBE_DIR)/ssh-key
+MASTER_IP := 192.168.122.10
+
+.PHONY: help build deploy down ssh wait-ssh ansible verify up lint fmt check
+
+help: ## Show this help
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | \
+		awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-15s\033[0m %s\n", $$1, $$2}'
+
+build: ## Build NixOS VM images
+	nix build .#images
+
+deploy: ## Destroy old VMs and create new ones from images
+	cd $(TOFU) && tofu destroy -auto-approve
+	cd $(TOFU) && tofu apply -auto-approve -var "image_dir=../result"
+
+down: ## Destroy all VMs
+	cd $(TOFU) && tofu destroy -auto-approve
+
+wait-ssh: ## Wait for SSH on master (checks every 5s, 60 retries)
+	@echo "Waiting for SSH on $(MASTER_IP)..."
+	@for i in $$(seq 1 60); do \
+		ssh -F /dev/null -o StrictHostKeyChecking=no -o IdentityAgent=none \
+			-o ConnectTimeout=5 -i $(SSH_KEY) root@$(MASTER_IP) true 2>/dev/null && \
+			echo "SSH ready." && exit 0; \
+		echo "  attempt $$i/60 — retrying in 5s..."; \
+		sleep 5; \
+	done; \
+	echo "ERROR: SSH not available after 5 minutes." && exit 1
+
+ssh: ## SSH into master node
+	ssh -F /dev/null -o StrictHostKeyChecking=no -o IdentityAgent=none \
+		-i $(SSH_KEY) root@$(MASTER_IP)
+
+ansible: ## Run full Ansible playbook (wait-ssh + Cilium + Rook-Ceph + verify)
+	cd $(ANSIBLE) && ansible-playbook site.yml
+
+verify: ## Run only the verify playbook
+	cd $(ANSIBLE) && ansible-playbook verify.yml
+
+up: build deploy wait-ssh ansible ## Full lifecycle: build → deploy → wait → install → verify
+
+lint: ## Run all linters
+	@echo "=== nixfmt ==="
+	@nix-shell -p nixfmt-rfc-style --run "nixfmt --check $(KUBE_DIR)/*.nix"
+	@echo "=== tflint ==="
+	@nix-shell -p tflint --run "tflint --recursive --chdir $(TOFU)"
+	@echo "=== ansible-lint ==="
+	@nix-shell -p ansible-lint --run "ansible-lint $(ANSIBLE)"
+	@echo "=== yamllint ==="
+	@nix-shell -p yamllint --run "yamllint -c $(KUBE_DIR)/../.yamllint $(KUBE_DIR)/../"
+	@echo "All lints passed."
+
+fmt: ## Format all files
+	@echo "=== nixfmt ==="
+	@nix-shell -p nixfmt-rfc-style --run "nixfmt $(KUBE_DIR)/*.nix"
+	@echo "=== tofu fmt ==="
+	@cd $(TOFU) && tofu fmt -recursive
+	@echo "All files formatted."
+
+check: lint ## Run all linters (alias for lint)