diff --git a/deploy_carvel/concierge/build.yaml b/deploy_carvel/concierge/build.yaml
new file mode 100644
index 00000000..ef3676fd
--- /dev/null
+++ b/deploy_carvel/concierge/build.yaml
@@ -0,0 +1,19 @@
+apiVersion: kbld.k14s.io/v1alpha1
+kind: Config
+minimumRequiredVersion: 0.31.0 # minimum version of kbld.  We probably don't need to specify.
+overrides:
+#! TODO: in the pinniped yamls, this is provided by values.yaml, not declared in the deployment.
+#!   we should assess if we want to leave it there or move it to this form of configuration.
+- image: projects.registry.vmware.com/pinniped/pinniped-server:latest
+  newImage: ""
+
+
+#! I don't think we need any of these (until we need them 😊).  IE, don't use prematurely.
+#! searchRules: ...  # for searching input files to find container images
+#! overrides: ...    # overrides to apply to container images before resolving or building
+#! sources: ...      # source/content of a container image
+#! destinations: ... # where to push built images
+#!
+#!
+#! source: TODO: we may need this at least to specify that we want kbld to build
+#!   a set of container images that are found in our package config yaml files.
diff --git a/deploy_carvel/concierge/metadata.yml b/deploy_carvel/concierge/metadata.yml
new file mode 100644
index 00000000..2cfc3bcf
--- /dev/null
+++ b/deploy_carvel/concierge/metadata.yml
@@ -0,0 +1,15 @@
+apiVersion: data.packaging.carvel.dev/v1alpha1
+kind: PackageMetadata
+metadata:
+  name: concierge.pinniped.dev
+spec:
+  displayName: "Pinniped Concierge"
+  longDescription: "Pinniped concierge enables consistent login across Kubernetes clusters on public cloud providers such as AKS, EKS and GKE"
+  shortDescription: "Pinniped concierge enables consistent login across public clouds"
+  categories:
+  - auth
+
+
+
+
+#@schema/nullable
diff --git a/deploy_carvel/concierge/package.yml b/deploy_carvel/concierge/package.yml
new file mode 100644
index 00000000..cbfe0a9b
--- /dev/null
+++ b/deploy_carvel/concierge/package.yml
@@ -0,0 +1,31 @@
+#@ load("@ytt:data", "data")  # for reading data values (generated via ytt's data-values-schema-inspect mode).
+#@ load("@ytt:yaml", "yaml")  # for dynamically decoding the output of ytt's data-values-schema-inspect
+---
+apiVersion: data.packaging.carvel.dev/v1alpha1
+kind: Package
+metadata:
+  name: #@ "concierge.pinniped.dev." + data.values.version
+spec:
+  refName: concierge.pinniped.dev
+  version: #@ data.values.version
+  releaseNotes: |
+        Initial release of the pinniped concierge package, TODO: AUTOMATE THIS??
+  valuesSchema:
+    openAPIv3: #@ yaml.decode(data.values.openapi)["components"]["schemas"]["dataValues"]
+  template:
+    spec:
+      fetch:
+      - imgpkgBundle:
+#! TODO: we will need a place to host this.
+#! this package image needs to be built and deployed so it can then be installed.
+          image: #@ "${REPO_HOST}/packages/pinniped-concierge:" + data.values.version
+      template:
+      - ytt:
+          paths:
+          - "config/"
+      - kbld:
+          paths:
+          - ".imgpkg/images.yml"
+          - "-"
+      deploy:
+      - kapp: {}
diff --git a/deploy_carvel/concierge/schema-openapi.yml b/deploy_carvel/concierge/schema-openapi.yml
new file mode 100644
index 00000000..9419f027
--- /dev/null
+++ b/deploy_carvel/concierge/schema-openapi.yml
@@ -0,0 +1,10 @@
+openapi: 3.0.0
+info:
+  version: 0.1.0
+  title: Schema for data values, generated by ytt
+paths: {}
+components:
+  schemas:
+    dataValues:
+      nullable: true
+      default: null