diff --git a/aodh/templates/secret-ingress-tls.yaml b/aodh/templates/secret-ingress-tls.yaml
new file mode 100644
index 0000000000..707b38cfa0
--- /dev/null
+++ b/aodh/templates/secret-ingress-tls.yaml
@@ -0,0 +1,19 @@
+{{/*
+Copyright 2019 Wind River Systems, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.manifests.secret_ingress_tls }}
+{{- include "helm-toolkit.manifests.secret_ingress_tls" ( dict "envAll" . "backendServiceType" "alarming" ) }}
+{{- end }}
diff --git a/aodh/values.yaml b/aodh/values.yaml
index 97da060285..65147b016a 100644
--- a/aodh/values.yaml
+++ b/aodh/values.yaml
@@ -542,6 +542,10 @@ secrets:
   oslo_messaging:
     admin: aodh-rabbitmq-admin
     aodh: aodh-rabbitmq-user
+  tls:
+    alarming:
+      api:
+        public: aodh-tls-public
 
 bootstrap:
   enabled: false
@@ -604,6 +608,13 @@ endpoints:
       public: aodh
     host_fqdn_override:
       default: null
+      # NOTE: this chart supports TLS for fqdn over-ridden public
+      # endpoints using the following format:
+      # public:
+      #   host: null
+      #   tls:
+      #     crt: null
+      #     key: null
     path:
       default: null
     scheme:
@@ -705,5 +716,6 @@ manifests:
   secret_db: true
   secret_keystone: true
   secret_rabbitmq: true
+  secret_ingress_tls: true
   service_api: true
   service_ingress_api: true
diff --git a/panko/templates/secret-ingress-tls.yaml b/panko/templates/secret-ingress-tls.yaml
new file mode 100644
index 0000000000..9773f5308a
--- /dev/null
+++ b/panko/templates/secret-ingress-tls.yaml
@@ -0,0 +1,19 @@
+{{/*
+Copyright 2019 Wind River Systems, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if .Values.manifests.secret_ingress_tls }}
+{{- include "helm-toolkit.manifests.secret_ingress_tls" ( dict "envAll" . "backendServiceType" "event" ) }}
+{{- end }}
diff --git a/panko/values.yaml b/panko/values.yaml
index 5229fa5b06..de75c0dc90 100644
--- a/panko/values.yaml
+++ b/panko/values.yaml
@@ -159,6 +159,10 @@ secrets:
   oslo_db:
     admin: panko-db-admin
     panko: panko-db-user
+  tls:
+    event:
+      api:
+        public: panko-tls-public
 
 bootstrap:
   enabled: false
@@ -387,6 +391,13 @@ endpoints:
       public: panko
     host_fqdn_override:
       default: null
+      # NOTE: this chart supports TLS for fqdn over-ridden public
+      # endpoints using the following format:
+      # public:
+      #   host: null
+      #   tls:
+      #     crt: null
+      #     key: null
     path:
       default: null
     scheme:
@@ -599,6 +610,7 @@ manifests:
   pod_rally_test: true
   secret_db: true
   secret_keystone: true
+  secret_ingress_tls: true
   service_api: true
   service_ingress_api: true