diff --git a/.github/workflows/pulumi-cloud-resource-openldap.yml b/.github/workflows/pulumi-cloud-resource-openldap.yml
new file mode 100644
index 00000000..bd9e65a7
--- /dev/null
+++ b/.github/workflows/pulumi-cloud-resource-openldap.yml
@@ -0,0 +1,67 @@
+name: setup openldap 
+
+on:
+  workflow_dispatch:
+    branches: [ 'main' ]
+
+env:
+  DNS_AK: ${{ secrets.DNS_AK }}
+  DNS_SK: ${{ secrets.DNS_SK }}
+  SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+  SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_KEY }}
+  PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_PASS }}
+  PULUMI_DISABLE_CI_DETECTION: true
+  AWS_REGION: ap-east-1
+
+defaults:
+  run:
+    working-directory: ./playbook
+
+jobs:
+  k3s-cluster:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: run playbook
+        shell: bash
+        run: |
+          export ANSIBLE_HOST_KEY_CHECKING=False
+
+          sudo apt install jq ansible -y
+          sudo rm -rvf /home/runner/.pulumi/
+          curl -o setup.sh https://get.pulumi.com && sh setup.sh --version 3.57.0
+
+          pulumi login s3://pulumi-aws-dev
+          pulumi stack select dev
+
+          db_server_public_ip=`pulumi stack output --json | jq '.db_server_public_ip'`
+          k3s_server_public_ip=`pulumi stack output --json | jq '.k3s_server_public_ip'`
+          
+          mkdir -pv ~/.ssh/
+          cat > ~/.ssh/id_rsa << EOF
+          ${SSH_PRIVATE_KEY}
+          EOF
+          sudo chmod 0400 ~/.ssh/id_rsa
+          md5sum ~/.ssh/id_rsa
+          
+          cat > hosts/inventory << EOF
+          [master]
+          k3s-server               ansible_host=$k3s_server_public_ip
+          
+          [node]
+          db-server                ansible_host=$db_server_public_ip
+          
+          [all:vars]
+          ansible_port=22
+          ansible_ssh_user=ubuntu
+          ansible_ssh_private_key_file=~/.ssh/id_rsa
+          ansible_host_key_checking=False
+          dns_ak=$DNS_AK
+          dns_sk=$DNS_SK
+          lb_ip=$k3s_server_public_ip
+          EOF
+          ansible-playbook -i hosts/inventory jobs/init_openldap -D
diff --git a/playbook/jobs/init_openldap b/playbook/jobs/init_openldap
new file mode 100644
index 00000000..1c0b0107
--- /dev/null
+++ b/playbook/jobs/init_openldap
@@ -0,0 +1,13 @@
+- name: setup redis 
+  hosts: all
+  user: root
+  become: yes
+  gather_facts: yes
+  tasks:
+    - include_role:
+        name: openldap
+      vars:
+        group: master
+        namespace: itsm
+        domain: onwalk.net
+        secret: openldap-tls
diff --git a/playbook/roles/cert-manager/files/certs.sh b/playbook/roles/cert-manager/files/certs.sh
new file mode 100644
index 00000000..0009efbd
--- /dev/null
+++ b/playbook/roles/cert-manager/files/certs.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+export Ali_Key=$1
+export Ali_Secret=$2
+export domain=$3
+export secret=$4
+export namespace=$5
+
+curl https://get.acme.sh | sh -s email=156405189@qq.com
+
+rm -rvf ${domain}.* -f
+sh ~/.acme.sh/acme.sh --set-default-ca --server zerossl --issue --force --dns dns_ali -d ${domain} -d "*.${domain}"
+cat ~/.acme.sh/${domain}/${domain}.cer > ${domain}.pem
+cat ~/.acme.sh/${domain}/ca.cer >> ${domain}.pem
+cat ~/.acme.sh/${domain}/${domain}.key > ${domain}.key
+
+kubectl create namespace $namespace || echo true
+kubectl delete secret tls $secret -n $namespace || echo true
+kubectl create secret tls $secret --cert=${domain}.pem --key=${domain}.key -n $namespace
diff --git a/playbook/roles/cert-manager/files/setup-mysql.sh b/playbook/roles/cert-manager/files/setup-mysql.sh
new file mode 100644
index 00000000..9c5abc15
--- /dev/null
+++ b/playbook/roles/cert-manager/files/setup-mysql.sh
@@ -0,0 +1,4 @@
+helm repo add bitnami https://charts.bitnami.com/bitnami
+helm repo up
+kubectl create ns database
+helm upgrade --install mysql bitnami/mysql -n database
diff --git a/playbook/roles/cert-manager/tasks/main.yml b/playbook/roles/cert-manager/tasks/main.yml
new file mode 100755
index 00000000..58527929
--- /dev/null
+++ b/playbook/roles/cert-manager/tasks/main.yml
@@ -0,0 +1,3 @@
+- name: Setup Kube cert secret
+  script: files/certs.sh {{ dns_ak }}  {{ dns_sk }} {{ domain }} {{ secret }} {{ namespace }}  
+  when: inventory_hostname in groups[group]
diff --git a/playbook/roles/oidc-server/files/setup-redis.sh b/playbook/roles/oidc-server/files/setup-redis.sh
new file mode 100644
index 00000000..d8c31894
--- /dev/null
+++ b/playbook/roles/oidc-server/files/setup-redis.sh
@@ -0,0 +1,4 @@
+helm repo add bitnami https://charts.bitnami.com/bitnami
+helm repo up
+kubectl create ns redis
+helm upgrade --install redis bitnami/redis -n redis
diff --git a/playbook/roles/oidc-server/tasks/main.yml b/playbook/roles/oidc-server/tasks/main.yml
new file mode 100755
index 00000000..f9a4309e
--- /dev/null
+++ b/playbook/roles/oidc-server/tasks/main.yml
@@ -0,0 +1,3 @@
+- name: Setup Redis Server
+  script: files/setup-redis.sh  
+  when: inventory_hostname in groups[group]
diff --git a/playbook/roles/openldap/files/setup-openldap.sh b/playbook/roles/openldap/files/setup-openldap.sh
new file mode 100644
index 00000000..63aa2c4c
--- /dev/null
+++ b/playbook/roles/openldap/files/setup-openldap.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+export domain=$1
+export secret=$2
+export namespace=$3
+
+cat > openldap-vaules.yaml << EOF
+global:
+  ldapDomain: $domain
+phpldapadmin:
+  enabled: true
+  ingress:
+    enabled: true
+    ingressClassName: nginx
+    hosts:
+      - openldap-admin.${domain}
+    tls:
+    - secretName: ${secret}
+      hosts:
+      - openldap-admin.${domain}
+ltb-passwd:
+  enabled: true
+  ingress:
+    enabled: true
+    ingressClassName: nginx
+    hosts:
+      - openldap-ltb.${domain}
+    tls:
+    - secretName: ${secret}
+      hosts:
+      - openldap-ltb.${domain}
+EOF
+
+helm repo add helm-openldap https://jp-gouin.github.io/helm-openldap/
+helm repo up
+kubectl create ns ${namespace} || echo true
+helm upgrade --install openldap helm-openldap/openldap-stack-ha -n ${namespace} --create-namespace -f openldap-vaules.yaml
diff --git a/playbook/roles/openldap/meta/main.yml b/playbook/roles/openldap/meta/main.yml
new file mode 100644
index 00000000..83cef7b5
--- /dev/null
+++ b/playbook/roles/openldap/meta/main.yml
@@ -0,0 +1,2 @@
+dependencies:
+  - role: cert-manager
diff --git a/playbook/roles/openldap/tasks/main.yml b/playbook/roles/openldap/tasks/main.yml
new file mode 100755
index 00000000..2ed6e29b
--- /dev/null
+++ b/playbook/roles/openldap/tasks/main.yml
@@ -0,0 +1,3 @@
+- name: Setup OpenLdap Server
+  script: files/setup-openldap.sh {{ domain }} {{ secret }} {{ namespace }}  
+  when: inventory_hostname in groups[group]