diff --git a/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml b/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml
new file mode 100644
index 0000000..d95d380
--- /dev/null
+++ b/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml
@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: sarex-wildcard
+  namespace: d8-ingress-istio
+spec:
+  commonName: "*.uralmine.com"
+  dnsNames:
+    - "*.uralmine.com"
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: sarex-selfsigned
+  privateKey:
+    rotationPolicy: Always
+  secretName: istio-ingress-tls
diff --git a/clusters/d8-ugmk-prod/istio-ingress/clusterissuer.yaml b/clusters/d8-ugmk-prod/istio-ingress/clusterissuer.yaml
new file mode 100644
index 0000000..8f75748
--- /dev/null
+++ b/clusters/d8-ugmk-prod/istio-ingress/clusterissuer.yaml
@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: sarex-selfsigned
+spec:
+  selfSigned: {}
diff --git a/clusters/d8-ugmk-prod/istio-ingress/ingress-controller.yaml b/clusters/d8-ugmk-prod/istio-ingress/ingress-controller.yaml
new file mode 100644
index 0000000..61af7b4
--- /dev/null
+++ b/clusters/d8-ugmk-prod/istio-ingress/ingress-controller.yaml
@@ -0,0 +1,22 @@
+apiVersion: deckhouse.io/v1alpha1
+kind: IngressIstioController
+metadata:
+  name: sarex
+spec:
+  ingressGatewayClass: istio
+  inlet: NodePort
+  nodePort:
+    httpPort: 30080
+    httpsPort: 30443
+  nodeSelector:
+    kubernetes.io/hostname: um-sarex-k8s-frontend-01
+  tolerations:
+    - effect: NoExecute
+      key: dedicated.deckhouse.io
+      operator: Equal
+      value: frontend
+  resourcesRequests:
+    mode: Static
+    static:
+      cpu: 100m
+      memory: 128Mi
diff --git a/clusters/d8-ugmk-prod/istio-ingress/kustomization.yaml b/clusters/d8-ugmk-prod/istio-ingress/kustomization.yaml
new file mode 100644
index 0000000..8ada48a
--- /dev/null
+++ b/clusters/d8-ugmk-prod/istio-ingress/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - clusterissuer.yaml
+  - certificate.yaml
+  - ingress-controller.yaml
diff --git a/clusters/d8-ugmk-prod/kustomization.yaml b/clusters/d8-ugmk-prod/kustomization.yaml
index dcb749b..9e4516b 100644
--- a/clusters/d8-ugmk-prod/kustomization.yaml
+++ b/clusters/d8-ugmk-prod/kustomization.yaml
@@ -4,4 +4,5 @@ resources:
   - ./flux-system
   - ./helm-repositories.yaml
   - ./infrastructure
+  - ./istio-ingress
   - ./bootstrap-jobs