diff --git a/apis/voyager/ingress.go b/apis/voyager/ingress.go
index 713fe0a41..d2e6b6989 100644
--- a/apis/voyager/ingress.go
+++ b/apis/voyager/ingress.go
@@ -110,7 +110,7 @@ type IngressTLS struct {
 	SecretName string `json:"secretName,omitempty"`
 
 	// SecretRef to used tls termination.
-	SecretRef apiv1.ObjectReference `json:"secretRef,omitempty"`
+	SecretRef *apiv1.ObjectReference `json:"secretRef,omitempty"`
 }
 
 // IngressStatus describe the current state of the Ingress.
diff --git a/apis/voyager/v1beta1/diff.go b/apis/voyager/v1beta1/diff.go
index cfe83e918..b785e0c98 100644
--- a/apis/voyager/v1beta1/diff.go
+++ b/apis/voyager/v1beta1/diff.go
@@ -56,9 +56,9 @@ func (r Ingress) HasChanged(o Ingress) (bool, error) {
 	return !reflect.DeepEqual(ra, oa), nil
 }
 
-func (r Ingress) FindTLSSecret(h string) (apiv1.ObjectReference, bool) {
+func (r Ingress) FindTLSSecret(h string) (*apiv1.ObjectReference, bool) {
 	if h == "" {
-		return apiv1.ObjectReference{}, false
+		return nil, false
 	}
 	for _, tls := range r.Spec.TLS {
 		for _, host := range tls.Hosts {
@@ -67,7 +67,7 @@ func (r Ingress) FindTLSSecret(h string) (apiv1.ObjectReference, bool) {
 			}
 		}
 	}
-	return apiv1.ObjectReference{}, false
+	return nil, false
 }
 
 func (r Ingress) IsPortChanged(o Ingress, cloudProvider string) bool {
diff --git a/apis/voyager/v1beta1/ingress.go b/apis/voyager/v1beta1/ingress.go
index 16a630f82..78df20c66 100644
--- a/apis/voyager/v1beta1/ingress.go
+++ b/apis/voyager/v1beta1/ingress.go
@@ -111,7 +111,7 @@ type IngressTLS struct {
 	SecretName string `json:"secretName,omitempty"`
 
 	// SecretRef to used tls termination.
-	SecretRef apiv1.ObjectReference `json:"secretRef,omitempty"`
+	SecretRef *apiv1.ObjectReference `json:"secretRef,omitempty"`
 }
 
 // IngressStatus describe the current state of the Ingress.
diff --git a/apis/voyager/v1beta1/validator.go b/apis/voyager/v1beta1/validator.go
index d86235a15..796082247 100644
--- a/apis/voyager/v1beta1/validator.go
+++ b/apis/voyager/v1beta1/validator.go
@@ -5,10 +5,10 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/appscode/go/reflect"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/validation"
+	apiv1 "k8s.io/client-go/pkg/api/v1"
 )
 
 type indices struct {
@@ -41,16 +41,20 @@ func (r *Ingress) IsValid(cloudProvider string) error {
 	}
 	for ti, tls := range r.Spec.TLS {
 		if tls.SecretName != "" {
-			if !reflect.IsZero(tls.SecretRef) &&
+			if tls.SecretRef != nil &&
 				!(tls.SecretRef.Name == tls.SecretName &&
 					(tls.SecretRef.Namespace == "" || tls.SecretRef.Namespace == r.Namespace) &&
 					(tls.SecretRef.Kind == "" || tls.SecretRef.Kind == "Secret")) {
 				return fmt.Errorf("spec.tls[%d] specifies different secret name and secret ref", ti)
 			}
-			tls.SecretRef.APIVersion = "v1"
-			tls.SecretRef.Kind = "Secret"
-			tls.SecretRef.Name = tls.SecretName
-		} else if reflect.IsZero(tls.SecretRef) {
+			if r.Spec.TLS[ti].SecretRef == nil {
+				r.Spec.TLS[ti].SecretRef = &apiv1.ObjectReference{
+					APIVersion: "v1",
+					Kind:       "Secret",
+					Name:       tls.SecretName,
+				}
+			}
+		} else if tls.SecretRef == nil {
 			return fmt.Errorf("spec.tls[%d] specifies no secret name and secret ref", ti)
 		} else {
 			if tls.SecretRef.Kind != "" && sets.NewString("Secret", "Certificate").Has(tls.SecretRef.Kind) {
diff --git a/apis/voyager/v1beta1/zz_generated.conversion.go b/apis/voyager/v1beta1/zz_generated.conversion.go
index d90d74b34..149977819 100644
--- a/apis/voyager/v1beta1/zz_generated.conversion.go
+++ b/apis/voyager/v1beta1/zz_generated.conversion.go
@@ -722,7 +722,7 @@ func Convert_voyager_IngressStatus_To_v1beta1_IngressStatus(in *voyager.IngressS
 func autoConvert_v1beta1_IngressTLS_To_voyager_IngressTLS(in *IngressTLS, out *voyager.IngressTLS, s conversion.Scope) error {
 	out.Hosts = *(*[]string)(unsafe.Pointer(&in.Hosts))
 	out.SecretName = in.SecretName
-	out.SecretRef = in.SecretRef
+	out.SecretRef = (*api_v1.ObjectReference)(unsafe.Pointer(in.SecretRef))
 	return nil
 }
 
@@ -734,7 +734,7 @@ func Convert_v1beta1_IngressTLS_To_voyager_IngressTLS(in *IngressTLS, out *voyag
 func autoConvert_voyager_IngressTLS_To_v1beta1_IngressTLS(in *voyager.IngressTLS, out *IngressTLS, s conversion.Scope) error {
 	out.Hosts = *(*[]string)(unsafe.Pointer(&in.Hosts))
 	out.SecretName = in.SecretName
-	out.SecretRef = in.SecretRef
+	out.SecretRef = (*api_v1.ObjectReference)(unsafe.Pointer(in.SecretRef))
 	return nil
 }
 
diff --git a/apis/voyager/v1beta1/zz_generated.deepcopy.go b/apis/voyager/v1beta1/zz_generated.deepcopy.go
index 04c235cf2..4ad36a3d7 100644
--- a/apis/voyager/v1beta1/zz_generated.deepcopy.go
+++ b/apis/voyager/v1beta1/zz_generated.deepcopy.go
@@ -566,6 +566,11 @@ func DeepCopy_v1beta1_IngressTLS(in interface{}, out interface{}, c *conversion.
 			*out = make([]string, len(*in))
 			copy(*out, *in)
 		}
+		if in.SecretRef != nil {
+			in, out := &in.SecretRef, &out.SecretRef
+			*out = new(api_v1.ObjectReference)
+			**out = **in
+		}
 		return nil
 	}
 }
diff --git a/apis/voyager/zz_generated.deepcopy.go b/apis/voyager/zz_generated.deepcopy.go
index cd20b9817..acaf22f78 100644
--- a/apis/voyager/zz_generated.deepcopy.go
+++ b/apis/voyager/zz_generated.deepcopy.go
@@ -533,6 +533,11 @@ func DeepCopy_voyager_IngressTLS(in interface{}, out interface{}, c *conversion.
 			*out = make([]string, len(*in))
 			copy(*out, *in)
 		}
+		if in.SecretRef != nil {
+			in, out := &in.SecretRef, &out.SecretRef
+			*out = new(api_v1.ObjectReference)
+			**out = **in
+		}
 		return nil
 	}
 }