diff --git a/config/configStructs/tapConfig.go b/config/configStructs/tapConfig.go
index 6a8bc4e42..c6a4b7029 100644
--- a/config/configStructs/tapConfig.go
+++ b/config/configStructs/tapConfig.go
@@ -80,10 +80,15 @@ type ResourcesConfig struct {
 	Hub    ResourceRequirements `yaml:"hub"`
 }
 
+type AuthConfig struct {
+	ApprovedDomains []string `yaml:"approvedDomains"`
+}
+
 type IngressConfig struct {
 	Enabled bool                    `yaml:"enabled" default:"false"`
 	Host    string                  `yaml:"host" default:"ks.svc.cluster.local"`
 	TLS     []networking.IngressTLS `yaml:"tls"`
+	Auth    AuthConfig              `yaml:"auth"`
 }
 
 type TapConfig struct {
diff --git a/kubernetes/provider.go b/kubernetes/provider.go
index e751990cb..09c9aabf0 100644
--- a/kubernetes/provider.go
+++ b/kubernetes/provider.go
@@ -265,6 +265,10 @@ func (provider *Provider) BuildHubPod(opts *PodOptions) (*core.Pod, error) {
 					Name:  "SCRIPTING_SCRIPTS",
 					Value: string(scriptsMarshalled),
 				},
+				{
+					Name:  "AUTH_APPROVED_DOMAINS",
+					Value: strings.Join(config.Config.Tap.Ingress.Auth.ApprovedDomains, ","),
+				},
 			},
 		},
 	}