diff --git a/charts/appmanager/templates/install.yaml b/charts/appmanager/templates/install.yaml
index d63827d..7274aa9 100644
--- a/charts/appmanager/templates/install.yaml
+++ b/charts/appmanager/templates/install.yaml
@@ -1,3 +1,27 @@
+kind: ClusterRole
+metadata:
+  name: {{ .Values.clusterRoleName }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Values.clusterRoleName }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.clusterRoleName }}
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace }}
+---
 apiVersion: v1
 kind: Secret
 metadata:
@@ -26,15 +50,19 @@
 metadata:
   name: ingress
   namespace: {{ .Release.Namespace }}
+  {{- if .Values.certificateIssuer }}
   annotations:
     acme.cert-manager.io/http01-edit-in-place: "true"
     cert-manager.io/cluster-issuer: {{ .Values.ingress.certificateIssuer}}
+  {{- end }}
 spec:
   ingressClassName: {{ .Values.ingress.className }}
+  {{- if .Values.certificateIssuer }}
   tls:
   - hosts:
     - {{ .Values.ingress.domain }}
     secretName: cert-appmanager
+  {{- end }}
   rules:
   - host: {{ .Values.ingress.domain }}
     http:
diff --git a/charts/appmanager/values.yaml b/charts/appmanager/values.yaml
index 572f74b..ac29afd 100644
--- a/charts/appmanager/values.yaml
+++ b/charts/appmanager/values.yaml
@@ -8,3 +8,4 @@
   className: example-ingress-private
   domain: apps.p.example.com
   certificateIssuer: example-private
+clusterRoleName: example-welcome