diff --git a/helm/longhorn/install.sh b/helm/longhorn/install.sh
new file mode 100755
index 0000000..2c8e458
--- /dev/null
+++ b/helm/longhorn/install.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+CHART_VERSION=1.4.4
+
+helm repo add longhorn https://charts.longhorn.io
+helm repo update
+helm upgrade --install \
+	longhorn \
+	longhorn/longhorn \
+	-n longhorn-system \
+	--version ${CHART_VERSION} \
+	--create-namespace \
+	--cleanup-on-fail
diff --git a/helm/longhorn/istio-ingress.yaml b/helm/longhorn/istio-ingress.yaml
new file mode 100644
index 0000000..1dff6a6
--- /dev/null
+++ b/helm/longhorn/istio-ingress.yaml
@@ -0,0 +1,56 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: longhorn-cert
+  namespace: istio-system
+spec:
+  secretName: longhorn-cert
+  commonName: longhorn.teapot.masked.name
+  dnsNames:
+    - longhorn.teapot.masked.name
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+...
+---
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: longhorn-gateway
+  namespace: longhorn-system
+spec:
+  selector:
+    istio: ingressgateway-internal
+  servers:
+  - port:
+      number: 443
+      name: https
+      protocol: HTTPS
+    tls:
+      mode: SIMPLE
+      credentialName: longhorn-cert
+    hosts:
+    - longhorn.teapot.masked.name
+...
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: longhorn-gateway
+  namespace: longhorn-system
+spec:
+  hosts:
+  - longhorn.teapot.masked.name
+  gateways:
+  - longhorn-gateway
+  http:
+  - match:
+    - uri:
+        prefix: /
+    route:
+    - destination:
+        port:
+          number: 80
+        host: longhorn-frontend