diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..e3b71b9
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,87 @@
+name: GraphRAG CI/CD
+
+on:
+  push:
+    branches: [master]
+    tags: ['v*']
+
+jobs:
+  build-and-deploy:
+    runs-on: docker
+    steps:
+      - name: Clone
+        run: |
+          git clone https://git.plfai.cn/test/GraphRAGAgent.git .
+          git checkout ${GITHUB_SHA}
+
+      - name: Set image tag
+        id: tag
+        run: |
+          if echo "${GITHUB_REF}" | grep -q 'refs/tags/'; then
+            IMG_TAG="${GITHUB_REF#refs/tags/}"
+            echo "ENV=prod" >> "$GITHUB_OUTPUT"
+          else
+            IMG_TAG="sha-${GITHUB_SHA:0:7}"
+            echo "ENV=test" >> "$GITHUB_OUTPUT"
+          fi
+          echo "TAG=${IMG_TAG}" >> "$GITHUB_OUTPUT"
+          echo "Image tag: ${IMG_TAG}"
+
+      - name: Build backend
+        run: |
+          docker build --network host \
+            -f backend/Dockerfile \
+            -t registry.plfai.cn/graphrag-backend:${{ steps.tag.outputs.TAG }} \
+            -t registry.plfai.cn/graphrag-backend:latest \
+            .
+
+      - name: Build frontend
+        run: |
+          docker build --network host \
+            -f frontend/Dockerfile \
+            -t registry.plfai.cn/graphrag-frontend:${{ steps.tag.outputs.TAG }} \
+            -t registry.plfai.cn/graphrag-frontend:latest \
+            .
+
+      - name: Push images
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.plfai.cn -u k3s --password-stdin
+          docker push registry.plfai.cn/graphrag-backend:${{ steps.tag.outputs.TAG }}
+          docker push registry.plfai.cn/graphrag-backend:latest
+          docker push registry.plfai.cn/graphrag-frontend:${{ steps.tag.outputs.TAG }}
+          docker push registry.plfai.cn/graphrag-frontend:latest
+
+      - name: Import to containerd
+        run: |
+          docker save registry.plfai.cn/graphrag-backend:${{ steps.tag.outputs.TAG }}  | k3s ctr images import -
+          docker save registry.plfai.cn/graphrag-frontend:${{ steps.tag.outputs.TAG }} | k3s ctr images import -
+
+      - name: Deploy to test
+        if: steps.tag.outputs.ENV == 'test'
+        run: |
+          NS=graphrag-test
+          TAG=${{ steps.tag.outputs.TAG }}
+
+          k3s kubectl set image deployment/backend  backend=registry.plfai.cn/graphrag-backend:${TAG}  -n ${NS}
+          k3s kubectl set image deployment/frontend frontend=registry.plfai.cn/graphrag-frontend:${TAG} -n ${NS}
+
+          k3s kubectl rollout status deployment/backend  -n ${NS} --timeout=120s
+          k3s kubectl rollout status deployment/frontend -n ${NS} --timeout=60s
+
+          sleep 3
+          curl -sk --connect-timeout 10 --retry 3 https://test-graphrag.plfai.cn/api/v1/health | grep healthy
+
+      - name: Deploy to prod
+        if: steps.tag.outputs.ENV == 'prod'
+        run: |
+          NS=graphrag-prod
+          TAG=${{ steps.tag.outputs.TAG }}
+
+          k3s kubectl set image deployment/backend  backend=registry.plfai.cn/graphrag-backend:${TAG}  -n ${NS}
+          k3s kubectl set image deployment/frontend frontend=registry.plfai.cn/graphrag-frontend:${TAG} -n ${NS}
+
+          k3s kubectl rollout status deployment/backend  -n ${NS} --timeout=120s
+          k3s kubectl rollout status deployment/frontend -n ${NS} --timeout=60s
+
+          sleep 3
+          curl -sk --connect-timeout 10 --retry 3 https://graphrag.plfai.cn/api/v1/health | grep healthy
diff --git a/k8s/base/backend-deployment.yaml b/k8s/base/backend-deployment.yaml
index bd99d49..b3005e9 100644
--- a/k8s/base/backend-deployment.yaml
+++ b/k8s/base/backend-deployment.yaml
@@ -17,6 +17,27 @@ spec:
         app: graphrag
         component: backend
     spec:
+      hostAliases:
+        - ip: "10.42.0.1"
+          hostnames:
+            - keycloak.plfai.cn
+      dnsConfig:
+        options:
+          - name: ndots
+            value: "1"
+          - name: timeout
+            value: "3"
+          - name: attempts
+            value: "2"
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/hostname
+                    operator: In
+                    values:
+                      - k8smaster
       containers:
         - name: backend
           image: registry.plfai.cn/graphrag-backend:latest
diff --git a/k8s/base/frontend-deployment.yaml b/k8s/base/frontend-deployment.yaml
index 4cb30b9..ad976b2 100644
--- a/k8s/base/frontend-deployment.yaml
+++ b/k8s/base/frontend-deployment.yaml
@@ -17,6 +17,23 @@ spec:
         app: graphrag
         component: frontend
     spec:
+      dnsConfig:
+        options:
+          - name: ndots
+            value: "1"
+          - name: timeout
+            value: "3"
+          - name: attempts
+            value: "2"
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/hostname
+                    operator: In
+                    values:
+                      - k8smaster
       containers:
         - name: frontend
           image: registry.plfai.cn/graphrag-frontend:latest