diff --git a/src/main/cljc/dda/c4k_keycloak/core.cljc b/src/main/cljc/dda/c4k_keycloak/core.cljc
index cb32c3d..ccf2870 100644
--- a/src/main/cljc/dda/c4k_keycloak/core.cljc
+++ b/src/main/cljc/dda/c4k_keycloak/core.cljc
@@ -42,8 +42,10 @@
          (postgres/generate-config config)
          [(kc/generate-configmap config)
           (kc/generate-service config)
+          (kc/generate-service-management-interface config)
           (kc/generate-deployment config)]
          (kc/generate-ratelimit-ingress config)
+         (kc/generate-ratelimit-ingress-management-interface config)
          (when (contains? config :mon-cfg)
            (mon/generate-config))))))
 
diff --git a/src/main/cljc/dda/c4k_keycloak/keycloak.cljc b/src/main/cljc/dda/c4k_keycloak/keycloak.cljc
index 639ea00..10a433b 100644
--- a/src/main/cljc/dda/c4k_keycloak/keycloak.cljc
+++ b/src/main/cljc/dda/c4k_keycloak/keycloak.cljc
@@ -43,6 +43,18 @@
                                    :namespace namespace}
                                   config))))
 
+(defn-spec generate-ratelimit-ingress-management-interface seq?
+  [config config?]
+  (let [{:keys [fqdn max-rate max-concurrent-requests namespace]} config]
+    (ing/generate-simple-ingress (merge
+                                  {:service-name "keycloak-management-interface"
+                                   :service-port 80
+                                   :fqdns [(str "control." fqdn)]
+                                   :average-rate max-rate
+                                   :burst-rate max-concurrent-requests
+                                   :namespace namespace}
+                                  config))))
+
 (defn-spec generate-secret cp/map-or-seq?
   [config config?
    auth auth?]
@@ -72,6 +84,13 @@
      (yaml/load-as-edn "keycloak/service.yaml")
      (cm/replace-all-matching "NAMESPACE" namespace))))
 
+(defn-spec generate-service-management-interface cp/map-or-seq?
+  [config config?]
+  (let [{:keys [namespace]} config]
+    (->
+     (yaml/load-as-edn "keycloak/service-management-interface.yaml")
+     (cm/replace-all-matching "NAMESPACE" namespace))))
+
 (defn-spec generate-deployment cp/map-or-seq?
   [config config?]
   (let [{:keys [fqdn namespace]} config]
diff --git a/src/main/resources/keycloak/service-management-interface.yaml b/src/main/resources/keycloak/service-management-interface.yaml
new file mode 100644
index 0000000..5927839
--- /dev/null
+++ b/src/main/resources/keycloak/service-management-interface.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak-management-interface
+  labels:
+    service: keycloak-management-interface
+  namespace: NAMESPACE
+spec:
+  ports:
+  - name: "http"
+    port: 80
+    targetPort: 9000
+  selector:
+    app: keycloak
\ No newline at end of file