diff --git a/clickhouse/app/clickhouse.yaml b/clickhouse/app/clickhouse.yaml
index 08ee3ea..e4f7080 100644
--- a/clickhouse/app/clickhouse.yaml
+++ b/clickhouse/app/clickhouse.yaml
@@ -11,6 +11,7 @@ spec:
       # to allow access outside from kubernetes
       admin/networks/ip:
         - 0.0.0.0/0
+      default/password: Transcity123
     zookeeper:
       nodes:
       - host: chk-keeper-chk-0-0
diff --git a/clickhouse/app/ingress.yaml b/clickhouse/app/ingress.yaml
new file mode 100644
index 0000000..28f92fe
--- /dev/null
+++ b/clickhouse/app/ingress.yaml
@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: clickhouse-ui
+  annotations:
+    cert-manager.io/cluster-issuer: admin
+    cert-manager.io/common-name: clickhouse.demo.aws.myseamlesstravel.com
+    cert-manager.io/private-key-algorithm: ECDSA
+    forecastle.stakater.com/appName: Clickhouse
+    forecastle.stakater.com/expose: 'true'
+    forecastle.stakater.com/group: Reports
+    forecastle.stakater.com/instance: admin
+spec:
+  ingressClassName: admin
+  rules:
+  - host: clickhouse.demo.aws.myseamlesstravel.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: clickhouse-clickhouse
+            port:
+              name: http
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - clickhouse.demo.aws.myseamlesstravel.com
+    secretName: clickhouse-ui-tls
diff --git a/clickhouse/app/kustomization.yaml b/clickhouse/app/kustomization.yaml
index a86d4ee..e7887d4 100644
--- a/clickhouse/app/kustomization.yaml
+++ b/clickhouse/app/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
 - namespace.yaml
 - keeper.yaml
 - clickhouse.yaml
+- ingress.yaml