diff --git a/Makefile b/Makefile
index 3a4a3fa..0de1609 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,5 @@
 IMAGE ?= controller:latest
+TOOLS_IMAGE ?= tools:latest
 PUSH_IMAGE ?= false
 PLATFORM ?= linux/amd64,linux/arm64
 
@@ -51,6 +52,9 @@ render-static-manifests:
 	@ $(SKAFFOLD) build -q -p release
 	@ $(KUSTOMIZE) build config/release > deploy/operator.yaml
 
+skaffold-build-tools:
+	$(SKAFFOLD) build -q -p tools -b tools
+
 # Generate manifests e.g. CRD, RBAC etc.
 manifests: controller-gen
 	$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
@@ -75,6 +79,10 @@ docker-build: test
 docker-build-dev:
 	docker buildx build . -t ${IMAGE} --platform ${PLATFORM} -f Dockerfile.dev --push=${PUSH_IMAGE}
 
+docker-build-tools:
+	@ echo "Building tools image with tag ${TOOLS_IMAGE}"
+	docker buildx build . -f cmd/update_k3osnodes_secret/Dockerfile -t ${TOOLS_IMAGE} --platform ${PLATFORM} --push=${PUSH_IMAGE}
+
 # find or download controller-gen
 # download controller-gen if necessary
 controller-gen:
diff --git a/cmd/update_k3osnodes_secret/Dockerfile b/cmd/update_k3osnodes_secret/Dockerfile
new file mode 100644
index 0000000..405c3b0
--- /dev/null
+++ b/cmd/update_k3osnodes_secret/Dockerfile
@@ -0,0 +1,32 @@
+# syntax=docker/dockerfile:1-experimental
+
+FROM --platform=${BUILDPLATFORM} golang:1.15-alpine AS base
+
+WORKDIR /workspace
+ENV CGO_ENABLED=0
+
+# Copy the Go Modules manifests
+COPY go.* .
+# cache deps before building and copying source so that we don't need to re-download as much
+# and so that source changes don't invalidate our downloaded layer
+RUN go mod download
+
+FROM base AS builder
+ARG TARGETOS
+ARG TARGETARCH
+
+# Copy the go source
+COPY cmd/update_k3osnodes_secret/main.go cmd/update_k3osnodes_secret/main.go
+
+# Build
+ENV GO111MODULE=on
+RUN --mount=type=cache,target=/root/.cache/go-build \
+  GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -mod=readonly -a -o update_k3osnodes_secret cmd/update_k3osnodes_secret/main.go
+
+# use distroless as minimal base image to package the binary
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY --from=builder /workspace/update_k3osnodes_secret .
+USER nonroot:nonroot
+
+ENTRYPOINT ["/update_k3osnodes_secret"]
diff --git a/cmd/update_k3osnodes_secret/main.go b/cmd/update_k3osnodes_secret/main.go
new file mode 100644
index 0000000..ec91568
--- /dev/null
+++ b/cmd/update_k3osnodes_secret/main.go
@@ -0,0 +1,15 @@
+package main
+
+import (
+	"fmt"
+)
+
+func main() {
+	// 1. read all YAML files in the config directory
+	// 2. parse them using github.com/annismckenzie/k3os-config-operator as a library
+	// 3. extract the node name
+	// 4. generate the secret into config/k3osconfig.yaml by using kustomize as a library
+	// 5. build this tool in the main Dockerfile using a multistage build, then add a Makefile target to invoke it on its own
+
+	fmt.Println("Successfully updated k3osconfig.yaml")
+}
diff --git a/skaffold.yaml b/skaffold.yaml
index 50fe42d..7a6c44a 100644
--- a/skaffold.yaml
+++ b/skaffold.yaml
@@ -20,6 +20,15 @@ profiles:
       kustomize:
         paths:
           - config/default
+  - name: tools
+    build:
+      local:
+        push: true
+      artifacts:
+        - image: ghcr.io/annismckenzie/k3os-config-operator/tools
+          custom:
+            buildCommand: "TOOLS_IMAGE=${IMAGE} make docker-build-tools"
+    deploy: {}
   - name: dev
     build:
       artifacts: