diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
new file mode 100644
index 0000000..3ebeb61
--- /dev/null
+++ b/k8s/deployment.yaml
@@ -0,0 +1,76 @@
+# =============================================================================
+# Deployment - node-bugado
+# =============================================================================
+#
+# Deployment com liveness e readiness probes.
+# A imagem é atualizada automaticamente pelo pipeline GitLab CI.
+#
+# =============================================================================
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: node-bugado
+  labels:
+    app: node-bugado
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: node-bugado
+  template:
+    metadata:
+      labels:
+        app: node-bugado
+    spec:
+      terminationGracePeriodSeconds: 5
+      containers:
+        - name: node-bugado
+          # IMPORTANTE: Esta linha é atualizada automaticamente pelo GitLab CI
+          image: registry.kube.quest/workshop/node-bugado:latest
+          ports:
+            - containerPort: 3000
+              name: http
+
+          # Variáveis de ambiente via ConfigMap
+          env:
+            - name: MAX_REQUESTS
+              valueFrom:
+                configMapKeyRef:
+                  name: node-bugado-config
+                  key: MAX_REQUESTS
+
+          # Recursos
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "100m"
+
+          # Liveness probe - detecta quando a app trava
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 3
+            failureThreshold: 2
+            timeoutSeconds: 2
+
+          # Readiness probe - remove do service enquanto não está pronta
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 3000
+            initialDelaySeconds: 2
+            periodSeconds: 2
+            failureThreshold: 1
+            timeoutSeconds: 1
+
+      # Pod security context
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000