diff --git a/testapp/linkerd-ingress-operator/Dockerfile b/testapp/linkerd-ingress-operator/Dockerfile
new file mode 100644
index 0000000..7e859fa
--- /dev/null
+++ b/testapp/linkerd-ingress-operator/Dockerfile
@@ -0,0 +1,5 @@
+FROM flant/shell-operator:latest
+RUN echo -e "root:x:0:0:root:/:\nappuser:x:1000:1000:appuser:/:" > /etc/passwd
+RUN echo -e "root:x:0:root\nappuser:x:1000:" > /etc/group
+ADD hooks /hooks
+USER appuser
diff --git a/testapp/linkerd-ingress-operator/Makefile b/testapp/linkerd-ingress-operator/Makefile
new file mode 100644
index 0000000..874cc66
--- /dev/null
+++ b/testapp/linkerd-ingress-operator/Makefile
@@ -0,0 +1,13 @@
+CC=docker
+APP=linkerd-ingress-operator
+TAG=127.0.0.1:5000/linkerd/$(APP):$(VERSION)
+
+all: build push
+
+build:
+	$(CC) build --build-arg VERSION=$(VERSION) -t $(TAG) .
+
+push:
+	$(CC) push $(TAG)
+
+.PHONY: build push
diff --git a/testapp/linkerd-ingress-operator/README.md b/testapp/linkerd-ingress-operator/README.md
new file mode 100644
index 0000000..c2f1fb9
--- /dev/null
+++ b/testapp/linkerd-ingress-operator/README.md
@@ -0,0 +1,31 @@
+# Linkerd Ingress Operator
+
+The Linkerd Ingress is an addon operator to annotate ingress's providing the mTLS destnation headers.
+
+Currently only the nginx ingress controller is supported.
+
+## Install
+
+Grant permissions for the new operator:
+
+```
+kubectl apply -f rbac.yaml
+```
+
+Create the operator pod:
+
+```
+kubectl apply -f pod.yaml
+```
+
+## Cleanup
+
+```
+kubectl delete -f pod.yaml
+kubectl delete -f rbac.yaml
+```
+
+## Todo
+
++ cleanup
+* more ingress controllers
diff --git a/testapp/linkerd-ingress-operator/hooks/ingress-add.sh b/testapp/linkerd-ingress-operator/hooks/ingress-add.sh
new file mode 100755
index 0000000..b822103
--- /dev/null
+++ b/testapp/linkerd-ingress-operator/hooks/ingress-add.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+if [[ $1 == "--config" ]]; then
+  cat <<EOF
+{
+  "onKubernetesEvent": [
+    {
+      "kind": "Ingress",
+      "event": ["add"]
+    }
+  ]
+}
+EOF
+else
+  json=${BINDING_CONTEXT_PATH}
+  ns=$(jq -r '.[0].resourceNamespace' ${json})
+  res=$(jq -r '.[0].resourceName' ${json})
+  tmp=$(mktemp)
+  kubectl -n "${ns}" get ingress "${res}" -ojson >${tmp} || { echo "error: getting ingress ${ns}/${res} failed">&2; exit 0; }
+  class=$(jq -r '.metadata.annotations."kubernetes.io/ingress.class"' ${tmp})
+  [[ "${class}" == "nginx" ]] || { echo "notice: ingress class ${ns}/${res} is not 'nginx'"; exit 0; }
+  port=$(jq -r '.spec.rules[0].http.paths[0].backend.servicePort' ${tmp})
+  ann=$(jq -r '.metadata.annotations."nginx.ingress.kubernetes.io/configuration-snippet"' ${tmp})
+  rm -f ${tmp}
+  [[ "${ann}" =~ "l5d-dst-override" ]] && { echo "notice: ingress ${ns}/${res} already has 'l5d-dst-override' header"; exit 0; }
+  [[ "${ann}" == "null" ]] && ann="" || ann="${ann}"$'\n'
+  ann="${ann}proxy_set_header l5d-dst-override \$service_name.\$namespace.svc.cluster.local:${port}"$';\nproxy_hide_header l5d-remote-ip;\nproxy_hide_header l5d-server-id;\n'
+  kubectl -n "${ns}" annotate ingress "${res}" nginx.ingress.kubernetes.io/configuration-snippet="${ann}"
+fi
diff --git a/testapp/linkerd-ingress-operator/pod.yaml b/testapp/linkerd-ingress-operator/pod.yaml
new file mode 100644
index 0000000..095c3d3
--- /dev/null
+++ b/testapp/linkerd-ingress-operator/pod.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: linkerd-ingress-operator
+  namespace: linkerd
+  labels:
+    app: linkerd-ingress-operator
+    version: v1
+spec:
+  containers:
+  - name: linkerd-ingress-operator
+    image: 127.0.0.1:5000/linkerd/linkerd-ingress-operator:v1
+    resources:
+      limits:
+        cpu: 100m
+        memory: 128Mi
+      requests:
+        cpu: 100m
+        memory: 128Mi
+    imagePullPolicy: Always
+  serviceAccountName: linkerd-ingress-operator
diff --git a/testapp/linkerd-ingress-operator/rbac.yaml b/testapp/linkerd-ingress-operator/rbac.yaml
new file mode 100644
index 0000000..0c69413
--- /dev/null
+++ b/testapp/linkerd-ingress-operator/rbac.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: linkerd-ingress-operator
+  namespace: linkerd
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: linkerd-ingress-operator
+rules:
+- apiGroups:
+  - extensions
+  resources:
+  - ingresses
+  verbs: ["get", "list", "watch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: linkerd-ingress-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: linkerd-ingress-operator
+subjects:
+- kind: ServiceAccount
+  name: linkerd-ingress-operator
+  namespace: linkerd