diff --git a/k8s/kevisual.cn/apps/esm.yaml b/k8s/kevisual.cn/apps/esm.yaml
new file mode 100644
index 0000000..fb895ea
--- /dev/null
+++ b/k8s/kevisual.cn/apps/esm.yaml
@@ -0,0 +1,75 @@
+# kubectl create namespace kevisual
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: esm
+  namespace: kevisual
+  labels:
+    app: esm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: esm
+  template:
+    metadata:
+      labels:
+        app: esm
+    spec:
+      containers:
+      - name: esm
+        image: ghcr.io/esm-dev/esm.sh:v136
+        ports:
+        - containerPort: 12000
+          protocol: TCP
+        env:
+        - name: LOG_LEVEL
+          value: "info"
+        - name: NPM_REGISTRY
+          value: "https://registry.npmmirror.com/"
+        - name: STORAGE_TYPE
+          value: "s3"
+        - name: STORAGE_S3_ENDPOINT
+          value: "http://kevisual.cn:9000"
+        - name: STORAGE_S3_ACCESS_KEY_ID
+          value: "abearxiong"
+        - name: STORAGE_S3_SECRET_ACCESS_KEY
+          value: "xiongxiao"
+      nodeSelector:
+        machine: "kevisual"
+  
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: esm
+  namespace: kevisual
+  labels:
+    app: esm
+spec:
+  type: ClusterIP
+  ports:
+  - port: 12000
+    targetPort: 12000
+    protocol: TCP
+    name: http
+  selector:
+    app: esm
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: esm-https
+  namespace: kevisual
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`esm.kevisual.cn`)
+      kind: Rule
+      services:
+        - name: esm
+          port: 12000
+  tls:
+    certResolver: letsencrypt
\ No newline at end of file