diff --git a/k8s/argocd-ingress.yaml b/k8s/argocd-ingress.yaml
new file mode 100644
index 0000000..371c728
--- /dev/null
+++ b/k8s/argocd-ingress.yaml
@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd-server-ingress
+  namespace: argocd
+  annotations:
+    cert-manager.io/cluster-issuer: lets-encrypt
+    ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    # If you encounter a redirect loop or are getting a 307 response code
+    # then you need to force the nginx ingress to connect to the backend using HTTPS.
+    #
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+spec:
+  ingressClassName: public
+  rules:
+    - host: argocd.2martens.de
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: argo-cd-argocd-server
+                port:
+                  name: https
+  tls:
+    - hosts:
+        - argocd.2martens.de
+      secretName: argocd-server-tls # as expected by argocd-server
\ No newline at end of file
diff --git a/k8s/certificate-issuer.yaml b/k8s/certificate-issuer.yaml
new file mode 100644
index 0000000..89641e7
--- /dev/null
+++ b/k8s/certificate-issuer.yaml
@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: lets-encrypt
+spec:
+  acme:
+    email: admin@2martens.de
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      # Secret resource that will be used to store the account's private key.
+      name: lets-encrypt-private-key
+    # Add a single challenge solver, HTTP01 using nginx
+    solvers:
+      - http01:
+          ingress:
+            class: public
\ No newline at end of file
diff --git a/k8s/log-access-cluster-role-binding.yaml b/k8s/log-access-cluster-role-binding.yaml
new file mode 100644
index 0000000..6d58dde
--- /dev/null
+++ b/k8s/log-access-cluster-role-binding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: log-access-127001
+subjects:
+  - kind: User
+    apiGroup: rbac.authorization.k8s.io
+    name: 127.0.0.1
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: log-access
diff --git a/k8s/log-access-cluster-role.yaml b/k8s/log-access-cluster-role.yaml
new file mode 100644
index 0000000..d1177ce
--- /dev/null
+++ b/k8s/log-access-cluster-role.yaml
@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: log-access
+rules:
+  - verbs:
+      - get
+    apiGroups:
+      - ''
+    resources:
+      - nodes/proxy
diff --git a/k8s/shell-access-cluster-role-binding.yaml b/k8s/shell-access-cluster-role-binding.yaml
new file mode 100644
index 0000000..9336a0d
--- /dev/null
+++ b/k8s/shell-access-cluster-role-binding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: shell-access-127001
+subjects:
+  - kind: User
+    apiGroup: rbac.authorization.k8s.io
+    name: 127.0.0.1
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: shell-access
diff --git a/k8s/shell-access-cluster-role.yaml b/k8s/shell-access-cluster-role.yaml
new file mode 100644
index 0000000..be7e72f
--- /dev/null
+++ b/k8s/shell-access-cluster-role.yaml
@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: shell-access
+rules:
+  - verbs:
+      - create
+    apiGroups:
+      - ''
+    resources:
+      - nodes/proxy
\ No newline at end of file