diff --git a/infrastructure/controllers/kubelet-csr-approver/kustomization.yaml b/infrastructure/controllers/kubelet-csr-approver/kustomization.yaml
new file mode 100644
index 0000000..795945b
--- /dev/null
+++ b/infrastructure/controllers/kubelet-csr-approver/kustomization.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - repository.yaml
+  - release.yaml
diff --git a/infrastructure/controllers/kubelet-csr-approver/release.yaml b/infrastructure/controllers/kubelet-csr-approver/release.yaml
new file mode 100644
index 0000000..7923cb7
--- /dev/null
+++ b/infrastructure/controllers/kubelet-csr-approver/release.yaml
@@ -0,0 +1,20 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kubelet-csr-approver
+  namespace: kube-system
+spec:
+  releaseName: kubelet-csr-approver
+  chart:
+    spec:
+      chart: kubelet-csr-approver
+      sourceRef:
+        kind: HelmRepository
+        name: kubelet-csr-approver
+  values:
+    providerRegex: ^(?:(?:kube|k[038]s))\d+$
+    providerIpPrefixes: 10.100.100.0/24
+    maxExpirationSeconds: 86400
+    bypassDnsResolution: false
+  interval: 1m
diff --git a/infrastructure/controllers/kubelet-csr-approver/repository.yaml b/infrastructure/controllers/kubelet-csr-approver/repository.yaml
new file mode 100644
index 0000000..809a18c
--- /dev/null
+++ b/infrastructure/controllers/kubelet-csr-approver/repository.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: kubelet-csr-approver
+  namespace: kube-system
+spec:
+  interval: 5m
+  url: https://postfinance.github.io/kubelet-csr-approver