diff --git a/k8s/benchmark-jobs.yaml b/k8s/benchmark-jobs.yaml
new file mode 100644
index 0000000..90b2c1d
--- /dev/null
+++ b/k8s/benchmark-jobs.yaml
@@ -0,0 +1,130 @@
+# Manually-triggered benchmark jobs comparing rbcs (java) vs rbcs-kaya (kaya-rbcs).
+# Create them with:
+#   kubectl create -f k8s/benchmark-jobs.yaml
+# (or `kubectl apply` — they only run when created, not on updates).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: rbcs-client-config
+  namespace: rbcs
+data:
+  rbcs-client.xml: |
+    <?xml version="1.0" encoding="UTF-8"?>
+    <profiles xmlns="urn:net.woggioni.rbcs.client">
+      <profile name="rbcs"
+               base-url="http://rbcs:8080/"
+               max-connections="50"
+               enable-compression="false">
+        <no-auth/>
+      </profile>
+      <profile name="rbcs-kaya"
+               base-url="http://rbcs-kaya:8080/"
+               max-connections="50"
+               enable-compression="false">
+        <no-auth/>
+      </profile>
+    </profiles>
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: benchmark-rbcs
+  namespace: rbcs
+  labels:
+    role: benchmark
+    target: rbcs
+spec:
+  backoffLimit: 1
+  ttlSecondsAfterFinished: 3600
+  template:
+    metadata:
+      labels:
+        role: benchmark
+        target: rbcs
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: client
+          image: gitea.woggioni.net/woggioni/rbcs:latest
+          args:
+            - client
+            - -p
+            - rbcs
+            - benchmark
+            - -s
+            - "256"
+            - -e
+            - "10000"
+          env:
+            - name: RBCS_CONFIGURATION_DIR
+              value: /etc/rbcs-config
+          volumeMounts:
+            - name: client-config
+              mountPath: /etc/rbcs-config
+              readOnly: true
+          resources:
+            requests:
+              cpu: "1"
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+      volumes:
+        - name: client-config
+          configMap:
+            name: rbcs-client-config
+            items:
+              - key: rbcs-client.xml
+                path: rbcs-client.xml
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: benchmark-kaya-rbcs
+  namespace: rbcs
+  labels:
+    role: benchmark
+    target: rbcs-kaya
+spec:
+  backoffLimit: 1
+  ttlSecondsAfterFinished: 3600
+  template:
+    metadata:
+      labels:
+        role: benchmark
+        target: rbcs-kaya
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: client
+          image: gitea.woggioni.net/woggioni/rbcs:latest
+          args:
+            - client
+            - -p
+            - rbcs-kaya
+            - benchmark
+            - -s
+            - "256"
+            - -e
+            - "10000"
+          env:
+            - name: RBCS_CONFIGURATION_DIR
+              value: /etc/rbcs-config
+          volumeMounts:
+            - name: client-config
+              mountPath: /etc/rbcs-config
+              readOnly: true
+          resources:
+            requests:
+              cpu: "1"
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+      volumes:
+        - name: client-config
+          configMap:
+            name: rbcs-client-config
+            items:
+              - key: rbcs-client.xml
+                path: rbcs-client.xml
diff --git a/k8s/deploy.yaml b/k8s/deploy.yaml
new file mode 100644
index 0000000..1202b5a
--- /dev/null
+++ b/k8s/deploy.yaml
@@ -0,0 +1,182 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: rbcs
+  labels:
+    kubernetes.io/metadata.name: rbcs
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: memcached
+  namespace: rbcs
+  labels:
+    app: memcached
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: memcached
+  template:
+    metadata:
+      labels:
+        app: memcached
+    spec:
+      containers:
+        - name: memcached
+          image: memcached:alpine
+          args: ["-m", "1024"]
+          ports:
+            - name: memcache
+              containerPort: 11211
+          resources:
+            requests:
+              cpu: "1"
+              memory: 1Gi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: memcached
+  namespace: rbcs
+spec:
+  selector:
+    app: memcached
+  ports:
+    - port: 11211
+      targetPort: 11211
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: rbcs-server-config
+  namespace: rbcs
+data:
+  rbcs-server.xml: |
+    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+    <rbcs:server xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+                 xmlns:rbcs="urn:net.woggioni.rbcs.server"
+                 xmlns:rbcs-memcache="urn:net.woggioni.rbcs.server.memcache"
+                 xs:schemaLocation="urn:net.woggioni.rbcs.server.memcache jpms://net.woggioni.rbcs.server.memcache/net/woggioni/rbcs/server/memcache/schema/rbcs-memcache.xsd urn:net.woggioni.rbcs.server jpms://net.woggioni.rbcs.server/net/woggioni/rbcs/server/schema/rbcs-server.xsd">
+        <bind host="0.0.0.0" port="8080" incoming-connections-backlog-size="1024"/>
+        <cache xs:type="rbcs-memcache:memcacheCacheType" max-age="P1D" key-prefix="rbcs">
+            <server host="memcached" port="11211" max-connections="50" connection-timeout="PT10S"/>
+        </cache>
+        <authentication>
+            <none/>
+        </authentication>
+    </rbcs:server>
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rbcs
+  namespace: rbcs
+  labels:
+    app: rbcs
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: rbcs
+  template:
+    metadata:
+      labels:
+        app: rbcs
+    spec:
+      containers:
+        - name: rbcs
+          image: gitea.woggioni.net/woggioni/rbcs:memcache
+          ports:
+            - name: http
+              containerPort: 8080
+          env:
+            - name: RBCS_CONFIGURATION_DIR
+              value: /etc/rbcs-config
+          volumeMounts:
+            - name: config
+              mountPath: /etc/rbcs-config
+              readOnly: true
+          resources:
+            requests:
+              cpu: "1"
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+      volumes:
+        - name: config
+          configMap:
+            name: rbcs-server-config
+            items:
+              - key: rbcs-server.xml
+                path: rbcs-server.xml
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: rbcs
+  namespace: rbcs
+spec:
+  selector:
+    app: rbcs
+  ports:
+    - port: 8080
+      targetPort: 8080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rbcs-kaya
+  namespace: rbcs
+  labels:
+    app: rbcs-kaya
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: rbcs-kaya
+  template:
+    metadata:
+      labels:
+        app: rbcs-kaya
+    spec:
+      containers:
+        - name: rbcs-kaya
+          image: gitea.woggioni.net/woggioni-opencode-agent/kaya-rbcs:0.0.2
+          ports:
+            - name: http
+              containerPort: 8080
+          env:
+            - name: RBCS_HOST
+              value: "0.0.0.0"
+            - name: RBCS_PORT
+              value: "8080"
+            - name: RBCS_MEMCACHE_HOST
+              value: memcached
+            - name: RBCS_MEMCACHE_PORT
+              value: "11211"
+            - name: RBCS_KEY_PREFIX
+              value: "kaya"
+          resources:
+            requests:
+              cpu: "1"
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: rbcs-kaya
+  namespace: rbcs
+spec:
+  selector:
+    app: rbcs-kaya
+  ports:
+    - port: 8080
+      targetPort: 8080
diff --git a/k8s/network-policies.yaml b/k8s/network-policies.yaml
new file mode 100644
index 0000000..47b9074
--- /dev/null
+++ b/k8s/network-policies.yaml
@@ -0,0 +1,134 @@
+# Default deny: no traffic in or out of the namespace unless explicitly allowed below.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+  namespace: rbcs
+spec:
+  podSelector: {}
+  policyTypes: [Ingress, Egress]
+---
+# Allow all pods to resolve services via cluster DNS.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns-egress
+  namespace: rbcs
+spec:
+  podSelector: {}
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+# memcached: only the two cache servers may reach it; it needs no egress.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: memcached-allow
+  namespace: rbcs
+spec:
+  podSelector:
+    matchLabels:
+      app: memcached
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchExpressions:
+              - key: app
+                operator: In
+                values: [rbcs, rbcs-kaya]
+      ports:
+        - protocol: TCP
+          port: 11211
+  egress: []
+---
+# rbcs (java): reachable by benchmark client pods only; egress to memcached only.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rbcs-allow
+  namespace: rbcs
+spec:
+  podSelector:
+    matchLabels:
+      app: rbcs
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              role: benchmark
+      ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: memcached
+      ports:
+        - protocol: TCP
+          port: 11211
+---
+# rbcs-kaya (kaya-rbcs): reachable by benchmark client pods only; egress to memcached only.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rbcs-kaya-allow
+  namespace: rbcs
+spec:
+  podSelector:
+    matchLabels:
+      app: rbcs-kaya
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              role: benchmark
+      ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: memcached
+      ports:
+        - protocol: TCP
+          port: 11211
+---
+# Benchmark client pods: no ingress; egress only to the two cache servers.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: benchmark-allow
+  namespace: rbcs
+spec:
+  podSelector:
+    matchLabels:
+      role: benchmark
+  policyTypes: [Ingress, Egress]
+  ingress: []
+  egress:
+    - to:
+        - podSelector:
+            matchExpressions:
+              - key: app
+                operator: In
+                values: [rbcs, rbcs-kaya]
+      ports:
+        - protocol: TCP
+          port: 8080