diff --git a/.github/workflows/deploy-k8s.yml b/.github/workflows/deploy-k8s.yml
new file mode 100644
index 0000000..bdcf35f
--- /dev/null
+++ b/.github/workflows/deploy-k8s.yml
@@ -0,0 +1,47 @@
+name: Deploy
+
+on:
+  push:
+    branches:
+    - master
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      NAMESPACE: globalart-prod
+      HARBOR_PROJECT: gitlab-prod
+      HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
+      HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
+      HARBOR_HOST: ${{ secrets.HARBOR_HOST }}
+      KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    - name: Setup kubectl
+      uses: azure/setup-kubectl@v1
+
+    - name: Setup helm
+      uses: azure/setup-helm@v1
+
+    - name: Install and setup werf
+      run: |
+        curl -sSL https://werf.io/install.sh | bash -s -- --version 1.2 --channel stable
+        echo 'source $("$HOME/bin/trdl" use werf "1.2" "stable")' >> $GITHUB_ENV
+
+    - name: Deploy
+      run: |
+        mkdir -p ~/.kube
+        echo "${{ secrets.KUBE_CONFIG }}" > ~/.kube/config
+        source $GITHUB_ENV
+        werf cr login -u $HARBOR_USERNAME -p $HARBOR_PASSWORD $HARBOR_HOST
+        werf converge --namespace=$NAMESPACE \
+              --env prod \
+              --kube-config=~/.kube/config \
+              --skip-tls-verify-registry=true \
+              --repo-container-registry=harbor \
+              --repo=$HARBOR_HOST/${HARBOR_PROJECT}/$GITHUB_REPOSITORY \
+              --repo-harbor-username=$HARBOR_USERNAME \
+              --repo-harbor-password=$HARBOR_PASSWORD \
+              --atomic=true