diff --git a/samples/cluster-tunnel/crd.yaml b/samples/cluster-tunnel/crd.yaml
new file mode 100644
index 0000000..ad6e364
--- /dev/null
+++ b/samples/cluster-tunnel/crd.yaml
@@ -0,0 +1,39 @@
+# New tunnel
+apiVersion: networking.cfargotunnel.com/v1alpha1
+kind: ClusterTunnel
+metadata:
+  name: new-tunnel
+spec:
+  newTunnel:
+    name: new-k8s-cluster-tunnel
+  size: 2
+  cloudflare:
+    domain: example.com
+    secret: cloudflare-secrets
+    # accountId and accountName cannot be both empty. If both are provided, Account ID is used if valid, else falls back to Account Name.
+    email: email@domain.com
+    accountName: <Cloudflare account name>
+    accountId: <Cloudflare account ID>
+    # CLOUDFLARE_API_TOKEN: <override key to be used reading from secret>
+    # CLOUDFLARE_API_KEY: <override key to be used reading from secret>
+# ---
+# # Existing tunnel
+# apiVersion: networking.cfargotunnel.com/v1alpha1
+# kind: ClusterTunnel
+# metadata:
+#   name: existing-tunnel
+# spec:
+#   existingTunnel:
+#     # id and name cannot be both empty. If both are provided, Tunnel ID is used if valid, else falls back to Tunnel Name.
+#     id: <tunnel ID>
+#     name: <tunnel Name>
+#   size: 2
+#   cloudflare:
+#     domain: example.com
+#     secret: cloudflare-secrets
+#     # accountId and accountName cannot be both empty. If both are provided, Account ID is used if valid, else falls back to Account Name.
+#     accountName: <Cloudflare account name>
+#     accountId: <Cloudflare account ID>
+#     # CLOUDFLARE_API_KEY: <override key to be used reading from secret>
+#     # CLOUDFLARE_TUNNEL_CREDENTIAL_FILE: <override key to be used reading from secret>
+#     # CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET: <override key to be used reading from secret>
diff --git a/samples/cluster-tunnel/kustomization.yaml b/samples/cluster-tunnel/kustomization.yaml
new file mode 100644
index 0000000..84a593c
--- /dev/null
+++ b/samples/cluster-tunnel/kustomization.yaml
@@ -0,0 +1,8 @@
+namespace: test-cloudflare-operator-cluster-tunnel
+namePrefix: test-cloudflare-operator-cluster-tunnel-
+
+resources:
+  - "./namespace.yaml"
+  - "./secrets.yaml"
+  - "./crd.yaml"
+  - "./service.yaml"
diff --git a/samples/cluster-tunnel/namespace.yaml b/samples/cluster-tunnel/namespace.yaml
new file mode 100644
index 0000000..26f659d
--- /dev/null
+++ b/samples/cluster-tunnel/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: app
diff --git a/samples/cluster-tunnel/secrets.yaml b/samples/cluster-tunnel/secrets.yaml
new file mode 100644
index 0000000..6ebca11
--- /dev/null
+++ b/samples/cluster-tunnel/secrets.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-secrets
+  namespace: cloudflare-operator-system # For a default installation, this will be the namespace for cluster resources
+type: Opaque
+data:
+  CLOUDFLARE_API_TOKEN: <API Key, base64 encoded>
+  CLOUDFLARE_API_KEY: <API Key, base64 encoded>
+  # CREDENTIAL_FILE is used if found, else CREDENTIAL_SECRET is used to build the file.
+  # Either of them is needed when using an existing tunnel
+  CLOUDFLARE_TUNNEL_CREDENTIAL_FILE: <~/.cloudflared/tunnelID.json, base64 encoded>
+  CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET: <TunnelSecret from ~/.cloudflared/tunnelID.json, base64 encoded>
diff --git a/samples/cluster-tunnel/service.yaml b/samples/cluster-tunnel/service.yaml
new file mode 100644
index 0000000..eb901b8
--- /dev/null
+++ b/samples/cluster-tunnel/service.yaml
@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: whoami
+spec:
+  selector:
+    matchLabels:
+      app: whoami
+  template:
+    metadata:
+      labels:
+        app: whoami
+    spec:
+      containers:
+        - name: whoami
+          image: traefik/whoami
+          resources:
+            limits:
+              memory: "128Mi"
+              cpu: "500m"
+          ports:
+            - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami-test
+  annotations:
+    cfargotunnel.com/cluster-tunnel: new-tunnel
+spec:
+  selector:
+    app: whoami
+  ports:
+    - port: 80
+      targetPort: 80
diff --git a/samples/crd.yaml b/samples/tunnel/crd.yaml
similarity index 100%
rename from samples/crd.yaml
rename to samples/tunnel/crd.yaml
diff --git a/samples/tunnel/kustomization.yaml b/samples/tunnel/kustomization.yaml
new file mode 100644
index 0000000..1ff265d
--- /dev/null
+++ b/samples/tunnel/kustomization.yaml
@@ -0,0 +1,8 @@
+namespace: test-cloudflare-operator-tunnel-app
+namePrefix: test-cloudflare-operator-tunnel-
+
+resources:
+  - "./namespace.yaml"
+  - "./secrets.yaml"
+  - "./crd.yaml"
+  - "./service.yaml"
diff --git a/samples/tunnel/namespace.yaml b/samples/tunnel/namespace.yaml
new file mode 100644
index 0000000..26f659d
--- /dev/null
+++ b/samples/tunnel/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: app
diff --git a/samples/secrets.yaml b/samples/tunnel/secrets.yaml
similarity index 100%
rename from samples/secrets.yaml
rename to samples/tunnel/secrets.yaml
diff --git a/samples/service.yaml b/samples/tunnel/service.yaml
similarity index 83%
rename from samples/service.yaml
rename to samples/tunnel/service.yaml
index 535b52b..d63f311 100644
--- a/samples/service.yaml
+++ b/samples/tunnel/service.yaml
@@ -1,13 +1,7 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: testing-crd
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: whoami
-  namespace: testing-crd
 spec:
   selector:
     matchLabels:
@@ -31,7 +25,6 @@ apiVersion: v1
 kind: Service
 metadata:
   name: whoami-test
-  namespace: testing-crd
   annotations:
     cfargotunnel.com/tunnel: new-tunnel
 spec: