diff --git a/charts/koptan/templates/certmanager.yaml b/charts/koptan/templates/certmanager.yaml
new file mode 100644
index 0000000..0078116
--- /dev/null
+++ b/charts/koptan/templates/certmanager.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.certManager.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ include "koptan.fullname" . }}-selfsigned-issuer
+  labels:
+    {{- include "koptan.labels" . | nindent 4 }}
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "koptan.fullname" . }}-serving-cert
+  labels:
+    {{- include "koptan.labels" . | nindent 4 }}
+spec:
+  dnsNames:
+  - {{ include "koptan.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc
+  - {{ include "koptan.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc.cluster.local
+  issuerRef:
+    kind: Issuer
+    name: {{ include "koptan.fullname" . }}-selfsigned-issuer
+  secretName: webhook-server-cert
+{{- end }}
diff --git a/charts/koptan/templates/deployment.yaml b/charts/koptan/templates/deployment.yaml
index b7e4cd5..fe49dd1 100644
--- a/charts/koptan/templates/deployment.yaml
+++ b/charts/koptan/templates/deployment.yaml
@@ -34,6 +34,11 @@ spec:
         - name: http
           containerPort: 8080
           protocol: TCP
+        {{- if .Values.webhook.enabled }}
+        - name: webhook-server
+          containerPort: 9443
+          protocol: TCP
+        {{- end }}
         resources:
           limits:
             cpu: 500m
@@ -59,4 +64,15 @@ spec:
             port: 8081
           initialDelaySeconds: 5
           periodSeconds: 10
-      volumes: []
+        {{- if .Values.webhook.enabled }}
+        volumeMounts:
+        - mountPath: /tmp/k8s-webhook-server/serving-certs
+          name: webhook-certs
+          readOnly: true
+        {{- end }}
+      volumes:
+      {{- if .Values.webhook.enabled }}
+      - name: webhook-certs
+        secret:
+          secretName: webhook-server-cert
+      {{- end }}
diff --git a/charts/koptan/templates/webhook-service.yaml b/charts/koptan/templates/webhook-service.yaml
new file mode 100644
index 0000000..1122b96
--- /dev/null
+++ b/charts/koptan/templates/webhook-service.yaml
@@ -0,0 +1,15 @@
+{{- if .Values.webhook.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "koptan.fullname" . }}-webhook-service
+  labels:
+    {{- include "koptan.labels" . | nindent 4 }}
+spec:
+  ports:
+  - port: 443
+    protocol: TCP
+    targetPort: 9443
+  selector:
+    {{- include "koptan.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/charts/koptan/templates/webhooks.yaml b/charts/koptan/templates/webhooks.yaml
new file mode 100644
index 0000000..c6fdd85
--- /dev/null
+++ b/charts/koptan/templates/webhooks.yaml
@@ -0,0 +1,186 @@
+{{- if .Values.webhook.enabled }}
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ include "koptan.fullname" . }}-mutating-webhook-configuration
+  labels:
+    {{- include "koptan.labels" . | nindent 4 }}
+  {{- if .Values.certManager.enabled }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "koptan.fullname" . }}-serving-cert
+  {{- end }}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ include "koptan.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /mutate-koptan-felukka-sh-v1alpha-goapp
+  failurePolicy: Fail
+  name: mgoapp-v1alpha.kb.io
+  rules:
+  - apiGroups:
+    - koptan.felukka.sh
+    apiVersions:
+    - v1alpha
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - goapps
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ include "koptan.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /mutate-koptan-felukka-sh-v1alpha-javaapp
+  failurePolicy: Fail
+  name: mjavaapp-v1alpha.kb.io
+  rules:
+  - apiGroups:
+    - koptan.felukka.sh
+    apiVersions:
+    - v1alpha
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - javaapps
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ include "koptan.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /mutate-koptan-felukka-sh-v1alpha-slipway
+  failurePolicy: Fail
+  name: mslipway-v1alpha.kb.io
+  rules:
+  - apiGroups:
+    - koptan.felukka.sh
+    apiVersions:
+    - v1alpha
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - slipways
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ include "koptan.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /mutate-koptan-felukka-sh-v1alpha-voyage
+  failurePolicy: Fail
+  name: mvoyage-v1alpha.kb.io
+  rules:
+  - apiGroups:
+    - koptan.felukka.sh
+    apiVersions:
+    - v1alpha
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - voyages
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ include "koptan.fullname" . }}-validating-webhook-configuration
+  labels:
+    {{- include "koptan.labels" . | nindent 4 }}
+  {{- if .Values.certManager.enabled }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "koptan.fullname" . }}-serving-cert
+  {{- end }}
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ include "koptan.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /validate-koptan-felukka-sh-v1alpha-goapp
+  failurePolicy: Fail
+  name: vgoapp-v1alpha.kb.io
+  rules:
+  - apiGroups:
+    - koptan.felukka.sh
+    apiVersions:
+    - v1alpha
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - goapps
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ include "koptan.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /validate-koptan-felukka-sh-v1alpha-javaapp
+  failurePolicy: Fail
+  name: vjavaapp-v1alpha.kb.io
+  rules:
+  - apiGroups:
+    - koptan.felukka.sh
+    apiVersions:
+    - v1alpha
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - javaapps
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ include "koptan.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /validate-koptan-felukka-sh-v1alpha-slipway
+  failurePolicy: Fail
+  name: vslipway-v1alpha.kb.io
+  rules:
+  - apiGroups:
+    - koptan.felukka.sh
+    apiVersions:
+    - v1alpha
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - slipways
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: {{ include "koptan.fullname" . }}-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /validate-koptan-felukka-sh-v1alpha-voyage
+  failurePolicy: Fail
+  name: vvoyage-v1alpha.kb.io
+  rules:
+  - apiGroups:
+    - koptan.felukka.sh
+    apiVersions:
+    - v1alpha
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - voyages
+  sideEffects: None
+{{- end }}
diff --git a/charts/koptan/values.yaml b/charts/koptan/values.yaml
index 9783f83..f08783d 100644
--- a/charts/koptan/values.yaml
+++ b/charts/koptan/values.yaml
@@ -60,3 +60,7 @@ volumeMounts: []
 nodeSelector: {}
 tolerations: []
 affinity: {}
+webhook:
+  enabled: false
+certManager:
+  enabled: false