diff --git a/.gitignore b/.gitignore
index d9568caf..02838a6a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,7 @@
 *swp
+bazel-bin
+bazel-genfiles
+bazel-out
+bazel-hscloud
+bazel-testlogs
+.kubectl
diff --git a/BUILD b/BUILD
new file mode 100644
index 00000000..e411b251
--- /dev/null
+++ b/BUILD
@@ -0,0 +1,8 @@
+# Gazelle settings
+
+load("@bazel_gazelle//:def.bzl", "gazelle")
+
+# gazelle:prefix code.hackerspace.pl/hscloud
+gazelle(
+    name = "gazelle",
+)
diff --git a/WORKSPACE b/WORKSPACE
new file mode 100644
index 00000000..57fa6285
--- /dev/null
+++ b/WORKSPACE
@@ -0,0 +1,48 @@
+# Go rules
+
+http_archive(
+    name = "io_bazel_rules_go",
+    url = "https://github.com/bazelbuild/rules_go/releases/download/0.16.5/rules_go-0.16.5.tar.gz",
+    sha256 = "7be7dc01f1e0afdba6c8eb2b43d2fa01c743be1b9273ab1eaf6c233df078d705",
+)
+
+load("@io_bazel_rules_go//go:def.bzl", "go_rules_dependencies", "go_register_toolchains")
+
+go_rules_dependencies()
+
+go_register_toolchains()
+
+# Go Gazelle rules
+
+http_archive(
+    name = "bazel_gazelle",
+    urls = ["https://github.com/bazelbuild/bazel-gazelle/releases/download/0.16.0/bazel-gazelle-0.16.0.tar.gz"],
+    sha256 = "7949fc6cc17b5b191103e97481cf8889217263acf52e00b560683413af204fcb",
+)
+
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
+
+gazelle_dependencies()
+
+# Go repositories
+
+go_repository(
+    name = "io_k8s_kubernetes",
+    importpath = "k8s.io/kubernetes",
+    # Get from HTTP instead, this repository is _big_
+    urls = ["https://github.com/kubernetes/kubernetes/archive/v1.13.2.tar.gz"],
+    sha256 = "2791a2be64e9e1d027962cdd2a42cdc90d26927623779aaf787b575fc623e2d7",
+    strip_prefix = "kubernetes-1.13.2",
+)
+
+go_repository(
+    name = "io_kubernetes_build",
+    commit = "796fd4636e54971f81cbbc663437d44c643159aa",
+    importpath = "k8s.io/repo-infra",
+)
+
+go_repository(
+    name = "com_github_ksonnet_kubecfg",
+    commit = "59bc7dedf70e7496a2837207d8723f98f0e5f8e8",
+    importpath = "github.com/ksonnet/kubecfg",
+)
diff --git a/bzl/BUILD b/bzl/BUILD
new file mode 100644
index 00000000..e69de29b
diff --git a/bzl/rules.bzl b/bzl/rules.bzl
new file mode 100644
index 00000000..996a07bd
--- /dev/null
+++ b/bzl/rules.bzl
@@ -0,0 +1,21 @@
+def _copy_go_binary_impl(ctx):
+    output = ctx.actions.declare_file(ctx.label.name)
+    for f in ctx.attr.src.files:
+        # go_binary rules have two outputs, a library and the binary itself.
+        # The following is a horrible hack to avoid copying the library.
+        if f.path.endswith(".a"):
+            continue
+        ctx.action(
+            inputs=[f],
+            outputs=[output],
+            mnemonic="CopyGoBinary",
+            command="mkdir -p %s && cp %s %s" % (output.dirname, f.path, output.path))
+        return [DefaultInfo(executable=output)]
+
+copy_go_binary = rule(
+    implementation=_copy_go_binary_impl,
+    attrs={
+        "src": attr.label(mandatory=True, allow_files=True),
+    },
+    executable=True,
+)
diff --git a/env.sh b/env.sh
index e58c0de7..cef844ef 100644
--- a/env.sh
+++ b/env.sh
@@ -7,6 +7,17 @@ fi
 
 hscloud_root="$( cd "$(dirname "$BASH_SOURCE")"; pwd -P )"
 
+if [ ! -f "$hscloud_root/WORKSPACE" ]; then
+    echo "Could not find WORKSPACE"
+    exit 1
+fi
+
+hscloud_path="$hscloud_root/bazel-bin/tools"
+
+[[ ":$PATH:" != *":$hscloud_path:"* ]] && PATH="$hscloud_path:${PATH}"
+
+# legacy crap follows
+
 hscloud-dc() {
     ( cd "$hscloud_root" && docker-compose -f "docker/docker-compose.yml" "$@" )
 }
@@ -202,9 +213,3 @@ hscloud-k8s-config() {
         kubectl config use-context default --kubeconfig=${kubeconfig}
     )
 }
-
-echo "Now playing:"
-echo "  hscloud-dc         - run docker-compose"
-echo "  hscloud-pki-dev    - generate dev PKI certs"
-echo "  hscloud-node-certs - ensure node has required certs"
-echo ""
diff --git a/tools/BUILD b/tools/BUILD
new file mode 100644
index 00000000..9a1df683
--- /dev/null
+++ b/tools/BUILD
@@ -0,0 +1,25 @@
+load("//bzl:rules.bzl", "copy_go_binary")
+
+py_binary(
+    name = "secretstore",
+    srcs = ["secretstore.py"],
+)
+
+copy_go_binary(
+    name = "kubectl",
+    src = "@io_k8s_kubernetes//cmd/kubectl:kubectl",
+)
+
+copy_go_binary(
+    name = "kubecfg",
+    src = "@com_github_ksonnet_kubecfg//:kubecfg",
+)
+
+filegroup(
+    name = "tools",
+    srcs = [
+        ":secretstore",
+        ":kubectl",
+        ":kubecfg",
+    ],
+)
diff --git a/cluster/scripts/secretstore b/tools/secretstore.py
old mode 100755
new mode 100644
similarity index 86%
rename from cluster/scripts/secretstore
rename to tools/secretstore.py
index d1945eca..6b88d286
--- a/cluster/scripts/secretstore
+++ b/tools/secretstore.py
@@ -12,7 +12,9 @@ keys = [
 
 def main():
     if len(sys.argv) < 3 or sys.argv[1] not in ('encrypt', 'decrypt'):
-        raise Exception("Usage: {} encrypt/decrypt file".format(sys.argv[0]))
+        sys.stderr.write("Usage: {} encrypt/decrypt file\n".format(sys.argv[0]))
+        sys.stderr.flush()
+        return 1
 
     action = sys.argv[1]
     src = sys.argv[2]