diff --git a/src/main/cljc/dda/c4k_common/ingress_cert.cljc b/src/main/cljc/dda/c4k_common/ingress_cert.cljc
new file mode 100644
index 0000000..9461831
--- /dev/null
+++ b/src/main/cljc/dda/c4k_common/ingress_cert.cljc
@@ -0,0 +1,78 @@
+(ns dda.c4k-common.ingress-cert
+  (:require
+   [clojure.spec.alpha :as s]
+   #?(:cljs [shadow.resource :as rc])
+   #?(:clj [orchestra.core :refer [defn-spec]]
+      :cljs [orchestra.core :refer-macros [defn-spec]])
+   #?(:clj [clojure.edn :as edn]
+      :cljs [cljs.reader :as edn])
+   [dda.c4k-common.yaml :as yaml]
+   [dda.c4k-common.common :as cm]
+   [dda.c4k-common.predicate :as pred]))
+
+(s/def ::issuer pred/letsencrypt-issuer?)
+(s/def ::service-name string?)
+(s/def ::app-name string?)
+(s/def ::ingress-name string?)
+(s/def ::cert-name string?)
+(s/def ::service-port pos-int?)
+(s/def ::fqdns (s/coll-of pred/fqdn-string?))
+
+(def ingress? (s/keys :req-un [::fqdns ::app-name ::ingress-name ::service-name ::service-port]
+                      :opt-un [::issuer ::cert-name]))
+
+(def certificate? (s/keys :req-un [::fqdns ::app-name ::cert-name]
+                          :opt-un [::issuer]))
+
+#?(:cljs
+   (defmethod yaml/load-resource :ingress [resource-name]
+     (case resource-name
+       "ingress/host-rule.yaml" (rc/inline "ingress/host-rule.yaml")
+       "ingress/certificate.yaml" (rc/inline "ingress/certificate.yaml")
+       "ingress/http-ingress.yaml" (rc/inline "ingress/http-ingress.yaml")
+       "ingress/https-ingress.yaml" (rc/inline "ingress/https-ingress.yaml")
+       (throw (js/Error. "Undefined Resource!")))))
+
+(defn-spec generate-host-rule  pred/map-or-seq?
+  [service-name ::service-name
+   service-port ::service-port
+   fqdn pred/fqdn-string?]
+  (->
+   (yaml/load-as-edn "ingress/host-rule.yaml")
+   (cm/replace-all-matching-values-by-new-value "FQDN" fqdn)
+   (cm/replace-all-matching-values-by-new-value "SERVICE_PORT" service-port)
+   (cm/replace-all-matching-values-by-new-value "SERVICE_NAME" service-name)))
+
+(defn-spec generate-http-ingress pred/map-or-seq?
+  [config ingress?]
+  (let [{:keys [ingress-name service-name service-port fqdns app-name]} config]
+    (->
+     (yaml/load-as-edn "ingress/http-ingress.yaml")
+     (assoc-in [:metadata :name] ingress-name)
+     (assoc-in [:metadata :labels :app.kubernetes.part-of] app-name)
+     (assoc-in [:spec :rules] (mapv (partial generate-host-rule service-name service-port) fqdns)))))
+
+(defn-spec generate-https-ingress pred/map-or-seq?
+  [config ingress?]
+  (let [{:keys [ingress-name cert-name service-name service-port fqdns app-name]} config]
+    (->
+     (yaml/load-as-edn "ingress/https-ingress.yaml")
+     (assoc-in [:metadata :name] ingress-name)
+     (assoc-in [:metadata :labels :app.kubernetes.part-of] app-name)
+     (assoc-in [:spec :tls 0 :secretName] cert-name)
+     (assoc-in [:spec :tls 0 :hosts] fqdns)
+     (assoc-in [:spec :rules] (mapv (partial generate-host-rule service-name service-port) fqdns)))))
+
+(defn-spec generate-certificate pred/map-or-seq?
+  [config certificate?]
+  (let [{:keys [cert-name issuer fqdns app-name]
+         :or {issuer "staging"}} config
+        letsencrypt-issuer (name issuer)]
+    (->
+     (yaml/load-as-edn "ingress/certificate.yaml")
+     (assoc-in [:metadata :name] cert-name)
+     (assoc-in [:metadata :labels :app.kubernetes.part-of] app-name)
+     (assoc-in [:spec :secretName] cert-name)
+     (assoc-in [:spec :commonName] (first fqdns))
+     (assoc-in [:spec :dnsNames] fqdns)
+     (assoc-in [:spec :issuerRef :name] letsencrypt-issuer))))
diff --git a/src/main/cljs/dda/c4k_common/yaml.cljs b/src/main/cljs/dda/c4k_common/yaml.cljs
index c8ec13b..33fd5c8 100644
--- a/src/main/cljs/dda/c4k_common/yaml.cljs
+++ b/src/main/cljs/dda/c4k_common/yaml.cljs
@@ -3,21 +3,28 @@
    ["js-yaml" :as yaml]
    [clojure.string :as st]
    [orchestra.core :refer-macros [defn-spec]]
+   [shadow.resource :as rc]
    [dda.c4k-common.predicate :as cp]))
 
+(defn string-or-keyword? [input]
+  (or (string? input) (keyword? input)))
+
 (defn-spec from-string cp/map-or-seq?
   [input string?]
   (js->clj (yaml/load input)
            :keywordize-keys true))
 
-(defn-spec to-string string? 
+(defn-spec to-string string?
   [edn cp/map-or-seq?]
   (yaml/dump (clj->js  edn)))
 
 (defn-spec dispatch-by-resource-name keyword?
-  [resource string?]
+  [resource string-or-keyword?]
   (keyword (first (st/split resource #"/"))))
 
 (defmulti load-resource dispatch-by-resource-name)
 
-(defmulti load-as-edn dispatch-by-resource-name)
\ No newline at end of file
+(defmulti load-as-edn dispatch-by-resource-name)
+
+(defmethod load-as-edn :default [resource-name]
+  (from-string (load-resource resource-name)))
diff --git a/src/main/resources/ingress/certificate.yaml b/src/main/resources/ingress/certificate.yaml
new file mode 100644
index 0000000..5020461
--- /dev/null
+++ b/src/main/resources/ingress/certificate.yaml
@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: c4k-common-cert
+  labels:
+    app.kubernetes.part-of: c4k-common-app
+  namespace: default
+spec:
+  secretName: c4k-common-cert
+  commonName: FQDN
+  duration: 2160h # 90d
+  renewBefore: 360h # 15d
+  dnsNames:
+  - FQDN
+  issuerRef:
+    name: staging
+    kind: ClusterIssuer
+    
\ No newline at end of file
diff --git a/src/main/resources/ingress/host-rule.yaml b/src/main/resources/ingress/host-rule.yaml
new file mode 100644
index 0000000..73d0e9f
--- /dev/null
+++ b/src/main/resources/ingress/host-rule.yaml
@@ -0,0 +1,10 @@
+host: FQDN
+http:
+  paths:
+    - pathType: Prefix
+      path: "/"
+      backend:
+        service:
+          name: SERVICE_NAME
+          port:
+            number: SERVICE_PORT
diff --git a/src/main/resources/ingress/http-ingress.yaml b/src/main/resources/ingress/http-ingress.yaml
new file mode 100644
index 0000000..b9d6153
--- /dev/null
+++ b/src/main/resources/ingress/http-ingress.yaml
@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: c4k-common-http-ingress
+  namespace: default
+  labels:
+    app.kubernetes.part-of: c4k-common-app
+  annotations:    
+    traefik.ingress.kubernetes.io/router.entrypoints: web    
+    traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd    
+spec:
+  rules:
+    - host: FQDN
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: SERVICE_NAME
+                port:
+                  number: 80
diff --git a/src/main/resources/ingress/https-ingress.yaml b/src/main/resources/ingress/https-ingress.yaml
new file mode 100644
index 0000000..e253be0
--- /dev/null
+++ b/src/main/resources/ingress/https-ingress.yaml
@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: c4k-common-https-ingress
+  namespace: default
+  labels:
+    app.kubernetes.part-of: c4k-common-app
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"    
+spec:
+  tls:
+    - hosts:
+        - FQDN
+      secretName: c4k-common-cert
+  rules:
+    - host: FQDN
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: SERVICE_NAME
+                port:
+                  number: 80
diff --git a/src/test/cljc/dda/c4k_common/common_test.cljc b/src/test/cljc/dda/c4k_common/common_test.cljc
index 7bdaeb5..f662af5 100644
--- a/src/test/cljc/dda/c4k_common/common_test.cljc
+++ b/src/test/cljc/dda/c4k_common/common_test.cljc
@@ -24,4 +24,4 @@
      (is (thrown? Exception
                   (cut/concat-vec ["a1" "a2"] 2)))
      (is (thrown? Exception
-                  (cut/concat-vec {"a1" "a2"} [])))))
+                  (cut/concat-vec {"a1" "a2"} [])))))
\ No newline at end of file
diff --git a/src/test/cljc/dda/c4k_common/ingress_cert_test.cljc b/src/test/cljc/dda/c4k_common/ingress_cert_test.cljc
new file mode 100644
index 0000000..5da7964
--- /dev/null
+++ b/src/test/cljc/dda/c4k_common/ingress_cert_test.cljc
@@ -0,0 +1,119 @@
+(ns dda.c4k-common.ingress-cert-test
+  (:require
+   #?(:clj [clojure.test :refer [deftest is are testing run-tests]]
+      :cljs [cljs.test :refer-macros [deftest is are testing run-tests]])
+   [clojure.spec.test.alpha :as st]
+   [dda.c4k-common.ingress-cert :as cut]))
+
+(st/instrument `cut/generate-host-rule)
+(st/instrument `cut/generate-http-ingress)
+(st/instrument `cut/generate-https-ingress)
+(st/instrument `cut/generate-certificate)
+
+
+(deftest should-generate-rule
+  (is (= {:host "test.com",
+          :http
+          {:paths
+           [{:pathType "Prefix",
+             :path "/",
+             :backend
+             {:service {:name "myservice", :port {:number 3000}}}}]}}
+         (cut/generate-host-rule "myservice" 3000 "test.com"))))
+
+
+(deftest should-generate-http-ingress
+  (is (= {:apiVersion "networking.k8s.io/v1",
+          :kind "Ingress",
+          :metadata
+          {:name "test-io-http-ingress",
+           :namespace "default",
+           :labels {:app.kubernetes.part-of "c4k-common-app"},
+           :annotations
+           #:traefik.ingress.kubernetes.io{:router.entrypoints "web",
+                                           :router.middlewares "default-redirect-https@kubernetescrd"}}}
+         (dissoc (cut/generate-http-ingress
+                  {:issuer "prod"
+                   :app-name "c4k-common-app"
+                   :service-name "myservice"
+                   :service-port 3000
+                   :ingress-name "test-io-http-ingress"
+                   :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}) :spec)))
+  (is (= {:rules
+          [{:host "test.de",
+            :http
+            {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}}
+           {:host "www.test.de",
+            :http
+            {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}}
+           {:host "test-it.de",
+            :http
+            {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}}
+           {:host "www.test-it.de",
+            :http
+            {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "myservice", :port {:number 3000}}}}]}}]}
+         (:spec (cut/generate-http-ingress
+                 {:issuer "prod"
+                  :service-name "myservice"
+                  :app-name "c4k-common-app"
+                  :service-port 3000
+                  :ingress-name "test-io-http-ingress"
+                  :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]})))))
+
+(deftest should-generate-https-ingress
+  (is (= {:apiVersion "networking.k8s.io/v1",
+          :kind "Ingress",
+          :metadata
+          {:name "test-io-https-ingress",
+           :namespace "default",
+           :labels {:app.kubernetes.part-of "c4k-common-app"},
+           :annotations #:traefik.ingress.kubernetes.io{:router.entrypoints "websecure", :router.tls "true"}}}
+         (dissoc (cut/generate-https-ingress
+                  {:issuer "prod"
+                   :service-name "test-io-service"
+                   :app-name "c4k-common-app"
+                   :service-port 80
+                   :ingress-name "test-io-https-ingress"
+                   :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]}) :spec)))
+  (is (= {:tls
+          [{:hosts
+            ["test.de" "www.test.de" "test-it.de" "www.test-it.de"],
+            :secretName "test-io-cert"}]
+          :rules
+          [{:host "test.de",
+            :http
+            {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}
+           {:host "www.test.de",
+            :http
+            {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}
+           {:host "test-it.de",
+            :http
+            {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}
+           {:host "www.test-it.de",
+            :http
+            {:paths [{:pathType "Prefix", :path "/", :backend {:service {:name "test-io-service", :port {:number 80}}}}]}}]}
+         (:spec (cut/generate-https-ingress {:issuer "prod"
+                                             :app-name "c4k-common-app"
+                                             :service-name "test-io-service"
+                                             :service-port 80
+                                             :ingress-name "test-io-https-ingress"
+                                             :cert-name "test-io-cert"
+                                             :fqdns ["test.de" "www.test.de" "test-it.de" "www.test-it.de"]})))))
+
+(deftest should-generate-certificate
+  (is (= {:apiVersion "cert-manager.io/v1",
+          :kind "Certificate",
+          :metadata {:name "test-io-cert",
+                     :namespace "default",
+                     :labels {:app.kubernetes.part-of "c4k-common-app"}},
+          :spec
+          {:secretName "test-io-cert",
+           :commonName "test.de",
+           :duration "2160h",
+           :renewBefore "360h",
+           :dnsNames ["test.de" "test.org" "www.test.de" "www.test.org"],
+           :issuerRef {:name "prod", :kind "ClusterIssuer"}}}
+         (cut/generate-certificate {:fqdns ["test.de" "test.org" "www.test.de" "www.test.org"]
+                                    :app-name "c4k-common-app"
+                                    :cert-name "test-io-cert"
+                                    :issuer "prod"}))))
\ No newline at end of file
diff --git a/src/test/cljs/dda/c4k_common/yaml_test.cljs b/src/test/cljs/dda/c4k_common/yaml_test.cljs
index cca3846..9b2775b 100644
--- a/src/test/cljs/dda/c4k_common/yaml_test.cljs
+++ b/src/test/cljs/dda/c4k_common/yaml_test.cljs
@@ -56,4 +56,4 @@
               [{:backend
                 {:serviceName "another_keycloak"
                  :servicePort 8081}}]}}]}}
-         (cut/from-string (cut/load-resource "test/ingress_test.yaml")))))
+         (cut/load-as-edn "test/ingress_test.yaml"))))