diff --git a/ops/monitoring/lib/global.libsonnet b/ops/monitoring/lib/global.libsonnet
index bd6bee3..b3a5eb7 100644
--- a/ops/monitoring/lib/global.libsonnet
+++ b/ops/monitoring/lib/global.libsonnet
@@ -1,4 +1,4 @@
-local kube = import "../../../kube/kube.libsonnet";
+local kube = import "../../../kube/hscloud.libsonnet";
 
 {
     // Global sets up a global tier instance of the hscloud monitoring infrastructure.
@@ -134,26 +134,9 @@
                 },
             },
 
-            ingressAPI: ns.Contain(kube.Ingress("victoria-api")) {
-                metadata+: {
-                    annotations+: {
-                        "kubernetes.io/tls-acme": "true",
-                        "cert-manager.io/cluster-issuer": "letsencrypt-prod",
-                    },
-                },
-                spec+: {
-                    tls: [
-                        { hosts: [cfg.hosts.globalAPI], secretName: "ingress-tls" },
-                    ],
-                    rules: [
-                        {
-                            host: cfg.hosts.globalAPI,
-                            http: {
-                                paths: [ { path: "/", backend: { serviceName: victoria.serviceAPI.metadata.name, servicePort: 8427 } }, ],
-                            },
-                        }
-                    ],
-                },
+            ingressAPI: ns.Contain(kube.SimpleIngress("victoria-api")) {
+                hosts:: [cfg.hosts.globalAPI],
+                target_service:: victoria.serviceAPI,
             },
         },
 
@@ -279,26 +262,9 @@
                 },
             },
 
-            ingress: ns.Contain(kube.Ingress("grafana-public")) {
-                metadata+: {
-                    annotations+: {
-                        "kubernetes.io/tls-acme": "true",
-                        "cert-manager.io/cluster-issuer": "letsencrypt-prod",
-                    },
-                },
-                spec+: {
-                    tls: [
-                        { hosts: [cfg.hosts.globalDashboard], secretName: "ingress-grafana-tls" },
-                    ],
-                    rules: [
-                        {
-                            host: cfg.hosts.globalDashboard,
-                            http: {
-                                paths: [ { path: "/", backend: { serviceName: grafana.service.metadata.name, servicePort: 3000 } }, ],
-                            },
-                        }
-                    ],
-                },
+            ingress: ns.Contain(kube.SimpleIngress("grafana-public")) {
+                hosts:: [cfg.hosts.globalDashboard],
+                target_service:: grafana.service,
             },
         },
     }
diff --git a/ops/sso/kube/sso.libsonnet b/ops/sso/kube/sso.libsonnet
index 7b51c72..58e3f8b 100644
--- a/ops/sso/kube/sso.libsonnet
+++ b/ops/sso/kube/sso.libsonnet
@@ -1,6 +1,6 @@
 #    kubectl create secret generic sso --from-literal=secret_key=$(pwgen 24 1) --from-literal=ldap_bind_password=...
 
-local kube = import "../../../kube/kube.libsonnet";
+local kube = import "../../../kube/hscloud.libsonnet";
 
 {
     local app = self,
@@ -104,31 +104,8 @@
         },
     },
 
-    ingress: app.ns.Contain(kube.Ingress("sso")) {
-        metadata+: {
-            annotations+: {
-                "kubernetes.io/tls-acme": "true",
-                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
-                "nginx.ingress.kubernetes.io/proxy-body-size": "0",
-            },
-        },
-        spec+: {
-            tls: [
-                {
-                    hosts: [cfg.domain],
-                    secretName: "sso-tls",
-                },
-            ],
-            rules: [
-                {
-                    host: cfg.domain,
-                    http: {
-                        paths: [
-                            { path: "/", backend: app.svc.name_port },
-                        ]
-                    },
-                }
-            ],
-        },
+    ingress: app.ns.Contain(kube.SimpleIngress("sso")) {
+        hosts:: [cfg.domain],
+        target_service:: app.svc,
     },
 }