diff --git a/aks-simple/README.md b/aks-simple/README.md
new file mode 100644
index 0000000..4aee27e
--- /dev/null
+++ b/aks-simple/README.md
@@ -0,0 +1,3 @@
+# Azure EKS Simple
+
+An Azure EKS app that runs a single container.
diff --git a/aks-simple/actions/simple_action.toml b/aks-simple/actions/simple_action.toml
new file mode 100644
index 0000000..b201d8b
--- /dev/null
+++ b/aks-simple/actions/simple_action.toml
@@ -0,0 +1,23 @@
+#:schema https://api.nuon.co/v1/general/config-schema?type=action
+
+name    = "simple_demonstration"
+timeout = "1m"
+
+[[triggers]]
+type = "post-provision"
+
+[[triggers]]
+type = "manual"
+
+[[steps]]
+name    = "create secrets in cluster"
+inline_contents = """
+#!/usr/bin/env sh
+password=`openssl rand -hex 12`
+kubectl create -n whoami secret generic whoami \
+  --save-config    \
+  --dry-run=client \
+  --from-literal=value="$password" \
+  -o yaml | kubectl apply -f -
+"""
+
diff --git a/aks-simple/components/alb.toml b/aks-simple/components/alb.toml
new file mode 100644
index 0000000..a3d2801
--- /dev/null
+++ b/aks-simple/components/alb.toml
@@ -0,0 +1,21 @@
+#:schema https://api.nuon.co/v1/general/config-schema?type=helm
+
+name         = "application_load_balancer"
+type         = "helm_chart"
+chart_name   = "application-load-balancer"
+dependencies = ["whoami"]
+
+[public_repo]
+repo      = "nuonco/example-app-configs"
+directory = "aks-simple/src/components/alb"
+branch    = "ja/pro-1515-https-cert-component"
+
+[values]
+domain             = "{{.nuon.inputs.inputs.sub_domain}}.{{.nuon.install.sandbox.outputs.public_domain.name}}"
+domain_certificate_secret_id = "{{.nuon.components.certificate.outputs.secret_id}}"
+https_port         = "443"
+service_name       = "whoami"
+service_port       = "80"
+install_name       = "{{.nuon.install.id}}"
+namespace          = "whoami"
+healthcheck_path   = "/health"
diff --git a/aks-simple/components/certificate.toml b/aks-simple/components/certificate.toml
new file mode 100644
index 0000000..768c743
--- /dev/null
+++ b/aks-simple/components/certificate.toml
@@ -0,0 +1,17 @@
+#:schema https://api.nuon.co/v1/general/config-schema?type=terraform
+
+name              = "certificate"
+type              = "terraform_module"
+terraform_version = "1.11.3"
+
+[public_repo]
+repo      = "nuonco/example-app-configs"
+directory = "aks-simple/src/components/certificate"
+branch    = "ja/pro-1515-https-cert-component"
+
+[vars]
+key_vault_name = "{{ .nuon.install_stack.outputs.key_vault_name }}"
+resource_group_name = "{{ .nuon.install_stack.outputs.resource_group_name }}"
+install_id  = "{{ .nuon.install.id }}"
+zone_id     = "{{ .nuon.install.sandbox.outputs.public_domain.id }}"
+domain_name = "*.{{ .nuon.install.sandbox.outputs.public_domain.name }}"
diff --git a/aks-simple/components/values/whoami.yaml b/aks-simple/components/values/whoami.yaml
new file mode 100644
index 0000000..f655a44
--- /dev/null
+++ b/aks-simple/components/values/whoami.yaml
@@ -0,0 +1,12 @@
+---
+namespace: "whoami"
+
+image:
+  tag: "latest"
+  repository: "traefik/whoami"
+
+deployment:
+  containerPort: 8000
+
+service:
+  port: 80
diff --git a/aks-simple/components/whoami.toml b/aks-simple/components/whoami.toml
new file mode 100644
index 0000000..ab4ab04
--- /dev/null
+++ b/aks-simple/components/whoami.toml
@@ -0,0 +1,15 @@
+#:schema https://api.nuon.co/v1/general/config-schema?type=helm
+
+name           = "whoami"
+type           = "helm_chart"
+chart_name     = "whoami"
+namespace      = "whoami"
+storage_driver = "configmap"
+
+[public_repo]
+repo      = "nuonco/example-app-configs"
+directory = "aks-simple/src/components/whoami"
+branch    = "ja/pro-1515-https-cert-component"
+
+[[values_file]]
+contents = "./values/whoami.yaml"
diff --git a/aks-simple/inputs.toml b/aks-simple/inputs.toml
new file mode 100644
index 0000000..b042482
--- /dev/null
+++ b/aks-simple/inputs.toml
@@ -0,0 +1,13 @@
+#:schema https://api.nuon.co/v1/general/config-schema?type=inputs
+
+[[group]]
+name         = "dns"
+description  = "DNS Configrations"
+display_name = "Configurations for the root domain for Route53"
+
+[[input]]
+name         = "root_domain"
+description  = "The root domain. Services will be made available at subdomains of this root domain."
+default      = "byoc.for.everyone.example.com"
+display_name = "Root Domain"
+group        = "dns"
diff --git a/aks-simple/metadata.toml b/aks-simple/metadata.toml
new file mode 100644
index 0000000..f0cb1e2
--- /dev/null
+++ b/aks-simple/metadata.toml
@@ -0,0 +1,7 @@
+#:schema https://api.nuon.co/v1/general/config-schema?type=metadata
+
+version = "v2"
+
+description = "An Azure EKS app that runs a single container."
+display_name = "Azure AKS Simple"
+readme       = "./README.md"
diff --git a/aks-simple/runner.toml b/aks-simple/runner.toml
new file mode 100644
index 0000000..626a4e4
--- /dev/null
+++ b/aks-simple/runner.toml
@@ -0,0 +1,7 @@
+#:schema https://api.nuon.co/v1/general/config-schema?type=runner
+
+runner_type = "azure"
+helm_driver = "configmap"
+
+[env_vars]
+foo = "bar"
diff --git a/aks-simple/sandbox.tfvars b/aks-simple/sandbox.tfvars
new file mode 100644
index 0000000..d925ca9
--- /dev/null
+++ b/aks-simple/sandbox.tfvars
@@ -0,0 +1,22 @@
+maintenance_role_eks_access_entry_policy_associations = {
+  eks_admin = {
+    policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy"
+    access_scope = {
+      type = "cluster"
+    }
+  }
+  eks_view = {
+    policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
+    access_scope = {
+      type = "cluster"
+    }
+  }
+}
+
+additional_namespaces = ["whoami"]
+
+maintenance_cluster_role_rules_override = [{
+  "apiGroups" = ["*"]
+  "resources" = ["*"]
+  "verbs"     = ["*"]
+}]
diff --git a/aks-simple/sandbox.toml b/aks-simple/sandbox.toml
new file mode 100644
index 0000000..8a57100
--- /dev/null
+++ b/aks-simple/sandbox.toml
@@ -0,0 +1,23 @@
+#:schema https://api.nuon.co/v1/general/config-schema?type=sandbox
+
+terraform_version = "1.11.3"
+
+[public_repo]
+repo      = "nuonco/terraform-azure-aks-sandbox"
+directory = "."
+branch    = "ja/pro-1534-secrets-syncing"
+
+[vars]
+cluster_name         = "n-{{.nuon.install.id}}"
+enable_nuon_dns      = "true"
+public_root_domain   = "{{ .nuon.inputs.inputs.root_domain }}"
+internal_root_domain = "internal.{{ .nuon.inputs.inputs.root_domain }}"
+location = "{{.nuon.cloud_account.azure.location}}"
+nuon_id = "{{.nuon.install.id}}"
+vnet_name = "{{.nuon.install_stack.outputs.network_name}}"
+resource_group_name = "{{.nuon.install_stack.outputs.resource_group_name}}"
+private_subnet_names = "{{.nuon.install_stack.outputs.private_subnet_names}}"
+public_subnet_names = "{{.nuon.install_stack.outputs.public_subnet_names}}"
+
+[[var_file]]
+contents = "./sandbox.tfvars"
diff --git a/aks-simple/src/components/alb/Chart.yaml b/aks-simple/src/components/alb/Chart.yaml
new file mode 100644
index 0000000..102c274
--- /dev/null
+++ b/aks-simple/src/components/alb/Chart.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: v2
+name: application-load-balancer
+description: A helm chart to create an alb.
+type: application
+version: v0.0.1
+appVersion: "0.0.1"
+
+dependencies: []
diff --git a/aks-simple/src/components/alb/README.md b/aks-simple/src/components/alb/README.md
new file mode 100644
index 0000000..070d32e
--- /dev/null
+++ b/aks-simple/src/components/alb/README.md
@@ -0,0 +1,50 @@
+# ALB
+
+Component to provision an ingress w/ annotations to make use of an AWS
+Certificate Manager SSL Certificate via the
+['certificate' component](../certificate).
+
+## Inputs/Variables
+
+| Variable             | Description                                             | Example                                                                  |
+| -------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------ |
+| `install_name`       | Typically, the install id.                              | `{{.nuon.install.id}}`                                                   |
+| `name`               | The name for the ingress.                               | `service-name`, `api`, ``                                                |
+| `domain`             | The ID of the zone. Can be sourced from the sandbox.    | `{{.nuon.install.sandbox.outputs.public_domain.name}}`                   |
+| `domain_certificate` | AWS Cerficate Manager Certificate ARN.                  | `{{.nuon.components.certificate.outputs.public_domain_certificate_arn}}` |
+| `https_port`         | port to use for https.                                  | `443` (default: `443`)                                                   |
+| `service_name`       | The name of the service this ingress routes traffic to. | `api`                                                                    |
+| `service_port`       | The port of the service this ingress routes traffic to. | `3000` (default: `3000`)                                                 |
+| `healthcheck_path`   | healthcheck path                                        | `/livez`, `/readyz`, `/health` (default: `/livez`)                       |
+
+Notes
+
+- if no `name` is provided, `{install_name}-pubulic` will be used.
+- if no `healtcheck_path` is provided the default `/livez` will be used.
+
+## Example Configuration
+
+```toml
+name       = "application_load_balancer"
+type       = "helm_chart"
+chart_name = "application-load-balancer"
+
+[public_repo]
+repo      = "nuonco/components"
+directory = "aws/alb"
+branch    = "main"
+
+[values]
+domain_certificate = "{{.nuon.components.certificate.outputs.public_domain_certificate_arn}}"
+domain             = "api.{{.nuon.install.sandbox.outputs.public_domain.name}}"
+https_port         = "443"
+service_name       = "api"
+service_port       = "api"
+install_name       = "{{.nuon.install.id}}"
+```
+
+## Note
+
+This component depends on outputs of the
+[`certificate` component](../certificate). It is important to note, the
+`domain_name` of the certificate component should match the `domain` value here.
diff --git a/aks-simple/src/components/alb/templates/alb.tpl b/aks-simple/src/components/alb/templates/alb.tpl
new file mode 100644
index 0000000..a9274f3
--- /dev/null
+++ b/aks-simple/src/components/alb/templates/alb.tpl
@@ -0,0 +1,52 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "common.name" . }}
+  annotations:
+    kubernetes.io/ingress.class: azure/application-gateway
+spec:
+  tls:
+    - hosts:
+      - {{ .Values.domain }}
+    - secretName: "https-cert"
+  rules:
+  - host: {{ .Values.domain }}
+    http:
+      paths:
+      - backend:
+          serviceName: {{ .Values.service_name }}
+          servicePort: {{ .Values.service_port | default "3000" }}
+
+# ---
+# apiVersion: networking.k8s.io/v1
+# kind: Ingress
+# metadata:
+#   name: {{ include "common.name" . }}
+#   namespace: {{ .Values.namespace }}
+#   labels:
+#     app.nuon.co/install: {{ .Values.install_name }}
+#   annotations:
+#     alb.ingress.kubernetes.io/scheme: internet-facing
+#     alb.ingress.kubernetes.io/target-type: ip
+#     alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":{{ .Values.https_port | default "443" }}}]'
+#     alb.ingress.kubernetes.io/aws-load-balancer-ssl-ports: https
+#     alb.ingress.kubernetes.io/healthcheck-path: {{ .Values.healthcheck_path | default "/livez" | quote }}
+#     alb.ingress.kubernetes.io/healthcheck-interval-seconds: '5'
+#     alb.ingress.kubernetes.io/healthcheck-timeout-seconds: '2'
+#     alb.ingress.kubernetes.io/unhealthy-threshold-count: '2'
+#     alb.ingress.kubernetes.io/healthy-threshold-count: '2'
+#     alb.ingress.kubernetes.io/certificate-arn: {{ .Values.domain_certificate }}
+#     external-dns.alpha.kubernetes.io/hostname: {{ .Values.domain }}
+# spec:
+#   ingressClassName: alb
+#   rules:
+#     - http:
+#         paths:
+#           - path: /
+#             pathType: Prefix
+#             backend:
+#               service:
+#                 name: {{ .Values.service_name }}
+#                 port:
+#                   number: {{ .Values.service_port | default "3000" }}
diff --git a/aks-simple/src/components/alb/templates/lib/_names.tpl b/aks-simple/src/components/alb/templates/lib/_names.tpl
new file mode 100644
index 0000000..c71945d
--- /dev/null
+++ b/aks-simple/src/components/alb/templates/lib/_names.tpl
@@ -0,0 +1,9 @@
+{{- define "common.name" -}}
+
+{{- if .Values.name }}
+{{- .Values.name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-public" .Values.install_name }}
+{{- end }}
+
+{{- end }}
diff --git a/aks-simple/src/components/alb/templates/sync-secret.tpl b/aks-simple/src/components/alb/templates/sync-secret.tpl
new file mode 100644
index 0000000..a9a5026
--- /dev/null
+++ b/aks-simple/src/components/alb/templates/sync-secret.tpl
@@ -0,0 +1,23 @@
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: azure-kv-sync
+  namespace: {{ .Values.namespace }}
+spec:
+  provider: azure
+  secretObjects:
+  - secretName: https-cert
+    type: Opaque
+    data:
+    - objectName: https-cert
+      key: https-cert
+  parameters:
+    useVMManagedIdentity: "true"
+    keyvaultName: {{. Values.key_vault_name }}
+    objects: |
+      array:
+        - |
+          objectName: https-cert
+          objectType: secret
+  tenantId: {{ .Values.tenant_id }}
diff --git a/aks-simple/src/components/alb/values.yaml b/aks-simple/src/components/alb/values.yaml
new file mode 100644
index 0000000..f3c42ec
--- /dev/null
+++ b/aks-simple/src/components/alb/values.yaml
@@ -0,0 +1,14 @@
+install_name: ""
+install_id: ""
+tenant_id: ""
+key_vault_name: ""
+
+name: ""
+domain: ""
+domain_certificate: ""
+https_port: ""
+service_name: ""
+service_port: ""
+
+healthcheck_path: "/livez"
+namespace: ""
diff --git a/aks-simple/src/components/certificate/.terraform.lock.hcl b/aks-simple/src/components/certificate/.terraform.lock.hcl
new file mode 100644
index 0000000..8e71062
--- /dev/null
+++ b/aks-simple/src/components/certificate/.terraform.lock.hcl
@@ -0,0 +1,25 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "5.97.0"
+  constraints = ">= 4.40.0, >= 5.67.0"
+  hashes = [
+    "h1:rUDE0OgA+6IiEA+w0cPp3/QQNH4SpjFjYcQ6p7byKS4=",
+    "zh:02790ad98b767d8f24d28e8be623f348bcb45590205708334d52de2fb14f5a95",
+    "zh:088b4398a161e45762dc28784fcc41c4fa95bd6549cb708b82de577f2d39ffc7",
+    "zh:0c381a457b7af391c43fc0167919443f6105ad2702bde4d02ddea9fd7c9d3539",
+    "zh:1a4b57a5043dcca64d8b8bae8b30ef4f6b98ed2144f792f39c4e816d3f1e2c56",
+    "zh:1bf00a67f39e67664337bde065180d41d952242801ebcd1c777061d4ffaa1cc1",
+    "zh:24c549f53d6bd022af31426d3e78f21264d8a72409821669e7fd41966ae68b2b",
+    "zh:3abda50bbddb35d86081fe39522e995280aea7f004582c4af22112c03ac8b375",
+    "zh:7388ed7f21ce2eb46bd9066626ce5f3e2a5705f67f643acce8ae71972f66eaf6",
+    "zh:96740f2ff94e5df2b2d29a5035a1a1026fe821f61712b2099b224fb2c2277663",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9f399f8e8683a3a3a6d63a41c7c3a5a5f266eedef40ea69eba75bacf03699879",
+    "zh:bcf2b288d4706ebd198f75d2159663d657535483331107f2cdef381f10688baf",
+    "zh:cc76c8a9fc3bad05a8779c1f80fe8c388734f1ec1dd0affa863343490527b466",
+    "zh:de4359cf1b057bfe7a563be93829ec64bf72e7a2b85a72d075238081ef5eb1db",
+    "zh:e208fa77051a1f9fa1eff6c5c58aabdcab0de1695b97cdea7b8dd81df3e0ed73",
+  ]
+}
diff --git a/aks-simple/src/components/certificate/README.md b/aks-simple/src/components/certificate/README.md
new file mode 100644
index 0000000..16ee742
--- /dev/null
+++ b/aks-simple/src/components/certificate/README.md
@@ -0,0 +1,30 @@
+# Certificate
+
+Component to provision an AWS Certificate Manager SSL Certificate.
+
+## Inputs/Variables
+
+| Variable      | Description                                          | Example                                                   |
+| ------------- | ---------------------------------------------------- | --------------------------------------------------------- |
+| `zone_id`     | The ID of the zone. Can be sourced from the sandbox. | `{{.nuon.install.sandbox.outputs.public_domain.zone_id}}` |
+| `domain_name` | The domain name. Usually provided by the sandbox.    | `{{.nuon.install.sandbox.outputs.public_domain.name}}`    |
+
+## Example Configuration
+
+```toml
+name = "certificate"
+type = "terraform_module"
+terraform_version = "1.10.4"
+
+[public_repo]
+repo      = "nuonco/components"
+directory = "aws/certificate"
+branch    = "main"
+
+[vars]
+zone_id     = "{{.nuon.install.sandbox.outputs.public_domain.zone_id}}"
+domain_name = "{{.nuon.install.sandbox.outputs.public_domain.name}}"
+# NOTE: it is also possible to use a subdomain or wildcard here.
+# domain_name = "subdomain.{{.nuon.install.sandbox.outputs.public_domain.name}}"
+# domain_name = "*.{{.nuon.install.sandbox.outputs.public_domain.name}}"
+```
diff --git a/aks-simple/src/components/certificate/main.tf b/aks-simple/src/components/certificate/main.tf
new file mode 100644
index 0000000..a3a6b79
--- /dev/null
+++ b/aks-simple/src/components/certificate/main.tf
@@ -0,0 +1,54 @@
+# resource "azurerm_key_vault_certificate" "main" {
+#   # name         = "${var.install_id}-cert"
+#   name         = "https-cert"
+#   key_vault_id = var.key_vault_id
+# 
+#   certificate_policy {
+#     issuer_parameters {
+#       name = "Self" # or "Unknown" for imported, or the name of a CA
+#     }
+# 
+#     key_properties {
+#       exportable = true
+#       key_size   = 2048
+#       key_type   = "RSA"
+#       reuse_key  = true
+#     }
+# 
+#     lifetime_action {
+#       action {
+#         action_type = "AutoRenew"
+#       }
+# 
+#       trigger {
+#         days_before_expiry = 30
+#       }
+#     }
+# 
+#     secret_properties {
+#       content_type = "application/x-pkcs12"
+#     }
+# 
+#     x509_certificate_properties {
+#       # Server Authentication = 1.3.6.1.5.5.7.3.1
+#       # Client Authentication = 1.3.6.1.5.5.7.3.2
+#       extended_key_usage = ["1.3.6.1.5.5.7.3.1"]
+# 
+#       key_usage = [
+#         "cRLSign",
+#         "dataEncipherment",
+#         "digitalSignature",
+#         "keyAgreement",
+#         "keyCertSign",
+#         "keyEncipherment",
+#       ]
+# 
+#       subject_alternative_names {
+#         dns_names = [var.domain_name]
+#       }
+# 
+#       subject            = "CN=${var.domain_name}"
+#       validity_in_months = 12
+#     }
+#   }
+# }
diff --git a/aks-simple/src/components/certificate/outputs.tf b/aks-simple/src/components/certificate/outputs.tf
new file mode 100644
index 0000000..95512f6
--- /dev/null
+++ b/aks-simple/src/components/certificate/outputs.tf
@@ -0,0 +1,15 @@
+# output "name" {
+#   value = azurerm_key_vault_certificate.main.name
+# }
+# 
+# output "key_vault_id" {
+#   value = azurerm_key_vault_certificate.main.key_vault_id
+# }
+# 
+# output "id" {
+#   value = azurerm_key_vault_certificate.main.id
+# }
+# 
+# output "secret_id" {
+#   value = azurerm_key_vault_certificate.main.secret_id
+# }
diff --git a/aks-simple/src/components/certificate/providers.tf b/aks-simple/src/components/certificate/providers.tf
new file mode 100644
index 0000000..ab91b24
--- /dev/null
+++ b/aks-simple/src/components/certificate/providers.tf
@@ -0,0 +1,3 @@
+provider "azurerm" {
+  features {}
+}
diff --git a/aks-simple/src/components/certificate/test.tf b/aks-simple/src/components/certificate/test.tf
new file mode 100644
index 0000000..0f46440
--- /dev/null
+++ b/aks-simple/src/components/certificate/test.tf
@@ -0,0 +1,28 @@
+data "azurerm_client_config" "current" {}
+
+output "client_object_id" {
+  value = data.azurerm_client_config.current.object_id
+}
+
+output "subscription_id" {
+  value = data.azurerm_client_config.current.subscription_id
+}
+
+output "tenant_id" {
+  value = data.azurerm_client_config.current.tenant_id
+}
+
+data "azurerm_key_vault" "test" {
+  name                = var.key_vault_name
+  resource_group_name = var.resource_group_name
+}
+
+output "vault_uri" {
+  value = data.azurerm_key_vault.test.vault_uri
+}
+
+# resource "azurerm_key_vault_secret" "test" {
+#   name         = "testsecret"
+#   value        = "sometestvalue"
+#   key_vault_id = data.azurerm_key_vault.test.id
+# }
diff --git a/aks-simple/src/components/certificate/variables.tf b/aks-simple/src/components/certificate/variables.tf
new file mode 100644
index 0000000..deea95a
--- /dev/null
+++ b/aks-simple/src/components/certificate/variables.tf
@@ -0,0 +1,19 @@
+variable "key_vault_name" {
+  type = string
+}
+
+variable "resource_group_name" {
+  type = string
+}
+
+variable "install_id" {
+  type = string
+}
+
+variable "domain_name" {
+  type = string
+}
+
+variable "zone_id" {
+  type = string
+}
diff --git a/aks-simple/src/components/certificate/versions.tf b/aks-simple/src/components/certificate/versions.tf
new file mode 100644
index 0000000..3919de5
--- /dev/null
+++ b/aks-simple/src/components/certificate/versions.tf
@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "=3.0.0"
+    }
+  }
+}
diff --git a/aks-simple/src/components/whoami/Chart.yaml b/aks-simple/src/components/whoami/Chart.yaml
new file mode 100644
index 0000000..78e189f
--- /dev/null
+++ b/aks-simple/src/components/whoami/Chart.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: v2
+name: whoami
+description: A helm chart to deploy whoami.
+type: application
+version: v0.0.1
+appVersion: "0.0.1"
+
+dependencies: []
diff --git a/aks-simple/src/components/whoami/templates/deployment.yaml b/aks-simple/src/components/whoami/templates/deployment.yaml
new file mode 100644
index 0000000..e6f2052
--- /dev/null
+++ b/aks-simple/src/components/whoami/templates/deployment.yaml
@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: whoami
+  namespace: {{ .Values.namespace | default .Release.Namespace | quote }}
+  labels:
+    app: whoami
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: whoami
+  template:
+    metadata:
+      labels:
+        app: whoami
+    spec:
+      containers:
+      - name: whoami
+        image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag }}"
+        env:
+        - name: "WHOAMI_PORT_NUMBER"
+          value: "{{ .Values.deployment.containerPort }}"
+        ports:
+        - containerPort: {{ .Values.deployment.containerPort }}
+        resources:
+          limits:
+            cpu: ".25"
+            memory: "128Mi"
+          requests:
+            cpu: ".1"
+            memory: "64Mi"
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: {{ .Values.deployment.containerPort }}
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: {{ .Values.deployment.containerPort }}
+          initialDelaySeconds: 5
+          periodSeconds: 5
diff --git a/aks-simple/src/components/whoami/templates/service.yaml b/aks-simple/src/components/whoami/templates/service.yaml
new file mode 100644
index 0000000..5e5b742
--- /dev/null
+++ b/aks-simple/src/components/whoami/templates/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami
+  namespace: {{ .Values.namespace | default .Release.Namespace | quote }}
+spec:
+  ports:
+  - name: http-whoami
+    port: 80
+    protocol: TCP
+    targetPort: {{ .Values.deployment.containerPort }}
+  selector:
+    app: whoami
+  sessionAffinity: None
+  type: ClusterIP
diff --git a/aks-simple/stack.toml b/aks-simple/stack.toml
new file mode 100644
index 0000000..d616975
--- /dev/null
+++ b/aks-simple/stack.toml
@@ -0,0 +1,5 @@
+#:schema https://api.nuon.co/v1/general/config-schema?type=stack
+
+type        = "azure-bicep"
+name        = "nuon-azure-aks-simple-{{.nuon.install.id}}"
+description = "Install the Nuon runner in an Azure resource group to manage a BYOC deployment of your app."