diff --git a/rolling.yaml b/rolling.yaml
new file mode 100644
index 0000000..fc027ee
--- /dev/null
+++ b/rolling.yaml
@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rolling-nginx
+spec:
+  replicas: 4
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 2
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      name: nginx
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.8
diff --git a/setup-docker.sh b/setup-docker.sh
index e9a7800..8bda7ee 100755
--- a/setup-docker.sh
+++ b/setup-docker.sh
@@ -27,9 +27,10 @@ EOF
 
 cat >> /etc/hosts << EOF
 {
-  192.168.4.111 control.example.com control
-  192.168.4.112 worker1.example.com worker1
-  192.168.4.113 worker2.example.com worker2
+  192.168.4.110 control.example.com control
+  192.168.4.111 worker1.example.com worker1
+  192.168.4.112 worker2.example.com worker2
+  192.168.4.113 worker3.example.com worker3
 }
 EOF
 
@@ -39,19 +40,4 @@ systemctl daemon-reload
 systemctl restart docker
 systemctl enable docker
 
-if [[ $HOSTNAME = control.example.com ]]
-then
-  firewall-cmd --add-port 6443/tcp --permanent
-  firewall-cmd --add-port 2379-2380/tcp --permanent
-  firewall-cmd --add-port 10250/tcp --permanent
-  firewall-cmd --add-port 10251/tcp --permanent
-  firewall-cmd --add-port 10252/tcp --permanent
-fi
-
-if echo $HOSTNAME | grep worker
-then
-  firewall-cmd --add-port 10250/tcp --permanent
-  firewall-cmd --add-port 30000-32767/tcp --permanent
-fi
-
-systemctl restart firewalld
+systemctl disable --now firewalld
diff --git a/stateful.yaml b/stateful.yaml
new file mode 100644
index 0000000..1ec8d8f
--- /dev/null
+++ b/stateful.yaml
@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  labels:
+    app: nginx
+spec:
+  ports:
+  - port: 80
+    name: web
+  clusterIP: None
+  selector:
+    app: nginx
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: web
+spec:
+  selector:
+    matchLabels:
+      app: nginx # has to match .spec.template.metadata.labels
+  serviceName: "nginx"
+  replicas: 3 # by default is 1
+  template:
+    metadata:
+      labels:
+        app: nginx # has to match .spec.selector.matchLabels
+    spec:
+      terminationGracePeriodSeconds: 10
+      containers:
+      - name: nginx
+        image: k8s.gcr.io/nginx-slim:0.8
+        ports:
+        - containerPort: 80
+          name: web
+        volumeMounts:
+        - name: www
+          mountPath: /usr/share/nginx/html
+  volumeClaimTemplates:
+  - metadata:
+      name: www
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      storageClassName: "my-storage-class"
+      resources:
+        requests:
+          storage: 1Gi