diff --git a/stable/nginx-ingress/Chart.yaml b/stable/nginx-ingress/Chart.yaml
index ceb711af03..8cab352b98 100644
--- a/stable/nginx-ingress/Chart.yaml
+++ b/stable/nginx-ingress/Chart.yaml
@@ -1,5 +1,5 @@
 name: nginx-ingress
-version: 0.27.0
+version: 0.28.0
 appVersion: 0.19.0
 home: https://github.com/kubernetes/ingress-nginx
 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration.
diff --git a/stable/nginx-ingress/README.md b/stable/nginx-ingress/README.md
index 26e579e834..337843cba1 100644
--- a/stable/nginx-ingress/README.md
+++ b/stable/nginx-ingress/README.md
@@ -149,6 +149,7 @@ Parameter | Description | Default
 `defaultBackend.service.type` | type of default backend service to create | `ClusterIP`
 `imagePullSecrets` | name of Secret resource containing private registry credentials | `nil`
 `rbac.create` | if `true`, create & use RBAC resources | `true`
+`podSecurityPolicy.enabled` | if `true`, create & use Pod Security Policy resources | `false`
 `serviceAccount.create` | if `true`, create a service account | ``
 `serviceAccount.name` | The name of the service account to use. If not set and `create` is `true`, a name is generated using the fullname template. | ``
 `revisionHistoryLimit` | The number of old history to retain to allow rollback. | `10`
diff --git a/stable/nginx-ingress/ci/psp-values.yaml b/stable/nginx-ingress/ci/psp-values.yaml
new file mode 100644
index 0000000000..7aae8605d5
--- /dev/null
+++ b/stable/nginx-ingress/ci/psp-values.yaml
@@ -0,0 +1,2 @@
+podSecurityPolicy:
+  enabled: true
diff --git a/stable/nginx-ingress/templates/podsecuritypolicy.yaml b/stable/nginx-ingress/templates/podsecuritypolicy.yaml
new file mode 100644
index 0000000000..c51d216230
--- /dev/null
+++ b/stable/nginx-ingress/templates/podsecuritypolicy.yaml
@@ -0,0 +1,47 @@
+{{- if .Values.podSecurityPolicy.enabled}}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "nginx-ingress.fullname" . }} 
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  allowedCapabilities:
+    - NET_BIND_SERVICE
+  privileged: false
+  allowPrivilegeEscalation: true
+  # Allow core volume types.
+  volumes:
+    - 'configMap'
+    #- 'emptyDir'
+    #- 'projected'
+    - 'secret'
+    #- 'downwardAPI'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    # Require the container to run without root privileges.
+    rule: 'MustRunAsNonRoot'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+  seLinux:
+    rule: 'RunAsAny'
+  hostPorts:
+    - max: 65535
+      min: 1
+{{- end }}
diff --git a/stable/nginx-ingress/templates/role.yaml b/stable/nginx-ingress/templates/role.yaml
index 94338ba3ad..64c47ca22e 100644
--- a/stable/nginx-ingress/templates/role.yaml
+++ b/stable/nginx-ingress/templates/role.yaml
@@ -79,4 +79,11 @@ rules:
     verbs:
       - create
       - patch
+{{- if .Values.podSecurityPolicy.enabled }}
+  - apiGroups:      ['extensions']
+    resources:      ['podsecuritypolicies']
+    verbs:          ['use']
+    resourceNames:  [{{ template "nginx-ingress.fullname" . }}]
+{{- end }}
+
 {{- end -}}
diff --git a/stable/nginx-ingress/values.yaml b/stable/nginx-ingress/values.yaml
index 102409354f..433fb6bc48 100644
--- a/stable/nginx-ingress/values.yaml
+++ b/stable/nginx-ingress/values.yaml
@@ -354,6 +354,11 @@ defaultBackend:
 rbac:
   create: true
 
+# If true, create & use Pod Security Policy resources
+# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
+podSecurityPolicy:
+  enabled: false
+
 serviceAccount:
   create: true
   name: