diff --git a/pkg/transformers/labelsandannotations_test.go b/pkg/transformers/labelsandannotations_test.go
index 67c719b05..041da6a95 100644
--- a/pkg/transformers/labelsandannotations_test.go
+++ b/pkg/transformers/labelsandannotations_test.go
@@ -38,6 +38,7 @@ var cronjob = schema.GroupVersionKind{Group: "batch", Version: "v1beta1", Kind:
 var pvc = schema.GroupVersionKind{Version: "v1", Kind: "PersistentVolumeClaim"}
 var crb = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "ClusterRoleBinding"}
 var sa = schema.GroupVersionKind{Version: "v1", Kind: "ServiceAccount"}
+var ingress = schema.GroupVersionKind{Kind: "Ingress"}
 
 func TestLabelsRun(t *testing.T) {
 	m := resmap.ResMap{
diff --git a/pkg/transformers/namereference_test.go b/pkg/transformers/namereference_test.go
index eef6b8ead..3415e6db2 100644
--- a/pkg/transformers/namereference_test.go
+++ b/pkg/transformers/namereference_test.go
@@ -59,6 +59,25 @@ func TestNameReferenceRun(t *testing.T) {
 					"name": "someprefix-claim1",
 				},
 			}),
+		resource.NewResId(ingress, "ingress1"): resource.NewResourceFromMap(
+			map[string]interface{}{
+				"group":      "extensions",
+				"apiVersion": "v1beta1",
+				"kind":       "Ingress",
+				"metadata": map[string]interface{}{
+					"name": "ingress1",
+					"annotations": map[string]interface{}{
+						"ingress.kubernetes.io/auth-secret": "secret1",
+					},
+				},
+				"spec": map[string]interface{}{
+					"backend": map[string]interface{}{
+						"serviceName": "testsvc",
+						"servicePort": "80",
+					},
+				},
+			},
+		),
 		resource.NewResId(deploy, "deploy1"): resource.NewResourceFromMap(
 			map[string]interface{}{
 				"group":      "apps",
@@ -282,6 +301,25 @@ func TestNameReferenceRun(t *testing.T) {
 				},
 			},
 		})
+	expected[resource.NewResId(ingress, "ingress1")] = resource.NewResourceFromMap(
+		map[string]interface{}{
+			"group":      "extensions",
+			"apiVersion": "v1beta1",
+			"kind":       "Ingress",
+			"metadata": map[string]interface{}{
+				"name": "ingress1",
+				"annotations": map[string]interface{}{
+					"ingress.kubernetes.io/auth-secret": "someprefix-secret1-somehash",
+				},
+			},
+			"spec": map[string]interface{}{
+				"backend": map[string]interface{}{
+					"serviceName": "testsvc",
+					"servicePort": "80",
+				},
+			},
+		},
+	)
 
 	nrt, err := NewDefaultingNameReferenceTransformer()
 	if err != nil {
diff --git a/pkg/transformers/namereferenceconfig.go b/pkg/transformers/namereferenceconfig.go
index 3672e1047..6eb8f5603 100644
--- a/pkg/transformers/namereferenceconfig.go
+++ b/pkg/transformers/namereferenceconfig.go
@@ -650,6 +650,13 @@ var defaultNameReferencePathConfigs = []ReferencePathConfig{
 				Path:               []string{"spec", "tls", "secretName"},
 				CreateIfNotPresent: false,
 			},
+			{
+				GroupVersionKind: &schema.GroupVersionKind{
+					Kind: "Ingress",
+				},
+				Path:               []string{"metadata", "annotations", "ingress.kubernetes.io/auth-secret"},
+				CreateIfNotPresent: false,
+			},
 			{
 				GroupVersionKind: &schema.GroupVersionKind{
 					Kind: "ServiceAccount",