diff --git a/tools/ingress/controller.yaml b/tools/ingress/controller.yaml
index 950981d7..17635551 100644
--- a/tools/ingress/controller.yaml
+++ b/tools/ingress/controller.yaml
@@ -39,6 +39,8 @@ spec:
   externalIPs:
     - EXTERNAL_IP
   ports:
+    - name: webui
+      port: WEBUI_PORT
     - name: http
       port: HTTP_PORT
     - name: https
diff --git a/tools/ingress/deploy-ingress-controller.sh b/tools/ingress/deploy-ingress-controller.sh
index f607e363..aa75bc73 100755
--- a/tools/ingress/deploy-ingress-controller.sh
+++ b/tools/ingress/deploy-ingress-controller.sh
@@ -8,6 +8,7 @@ function usage {
     echo "  $base_name -i <external IP>"
     echo "  $base_name -p <http port (default: 80)>"
     echo "  $base_name -s <https port (default: 8443)>"
+    echo "  $base_name -w <webui port (default: 8088)>"
     echo "  $base_name -n <namespace>"
     echo "  $base_name -k <path to tls key>"
     echo "  $base_name -c <path to tls cert>"
@@ -16,10 +17,11 @@ function usage {
 
 NAMESPACE=" --namespace kube-system"
 DOMAIN="ccp.external"
+WEBUI_PORT=8088
 HTTP_PORT=80
 HTTPS_PORT=8443
 
-while getopts "p:s:k:c:d:n:i:h" opt; do
+while getopts "p:s:w:k:c:d:n:i:h" opt; do
     case $opt in
         "p" )
             HTTP_PORT="$OPTARG"
@@ -27,6 +29,9 @@ while getopts "p:s:k:c:d:n:i:h" opt; do
         "s" )
             HTTPS_PORT="$OPTARG"
             ;;
+        "w" )
+            WEBUI_PORT="$OPTARG"
+            ;;
         "k" )
             TLS_KEY="$OPTARG"
             ;;
@@ -75,9 +80,9 @@ if [ -z $TLS_KEY ] || [ -z $TLS_CERT ]; then
 fi
 
 kube_cmd create secret generic traefik-cert --from-file=$TLS_CERT --from-file=$TLS_KEY
-sed -e "s/HTTP_PORT/$HTTP_PORT/g" -e "s/HTTPS_PORT/$HTTPS_PORT/g" $workdir/traefik-conf.yaml | kube_cmd create -f -
+sed -e "s/HTTP_PORT/$HTTP_PORT/g" -e "s/HTTPS_PORT/$HTTPS_PORT/g" -e "s/WEBUI_PORT/$WEBUI_PORT/g" $workdir/traefik-conf.yaml | kube_cmd create -f -
 sleep 1
-sed -e "s/HTTP_PORT/$HTTP_PORT/g" -e "s/HTTPS_PORT/$HTTPS_PORT/g" -e "s/EXTERNAL_IP/$EXTERNAL_IP/g" $workdir/controller.yaml | kube_cmd create -f -
+sed -e "s/HTTP_PORT/$HTTP_PORT/g" -e "s/HTTPS_PORT/$HTTPS_PORT/g" -e "s/WEBUI_PORT/$WEBUI_PORT/g" -e "s/EXTERNAL_IP/$EXTERNAL_IP/g" $workdir/controller.yaml | kube_cmd create -f -
 
 if [ -n $CLEANUP ]; then
     rm $TLS_KEY $TLS_CERT
diff --git a/tools/ingress/traefik-conf.yaml b/tools/ingress/traefik-conf.yaml
index ee10b6bc..bdceca74 100644
--- a/tools/ingress/traefik-conf.yaml
+++ b/tools/ingress/traefik-conf.yaml
@@ -5,6 +5,11 @@ metadata:
 data:
   traefik.toml: |
     defaultEntryPoints = ["http","https"]
+    [web]
+    address = ":WEBUI_PORT"
+    ReadOnly = true
+    CertFile = "/ssl/tls.crt"
+    KeyFile = "/ssl/tls.key"
     [entryPoints]
       [entryPoints.http]
       address = ":HTTP_PORT"