diff --git a/README.md b/README.md
index c06c340..64f4bc4 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # GitOps repository
 
+## Hypervisor
+
 ### 1) Harvester Hyperconverged Infrastructure
 [...]  
 
@@ -7,6 +9,180 @@ Configure Harvester HCI nodes through cloud-init (requires node reboot):
 ```shell
 kubectl apply -f system/Harvester/cloudinit-disable-nic-offloading.yaml
 ```
+## Downstream cluster(s)
+
+Cluster configuration for RKE2 cluster using kube-vip with Traefik ingress controller:
+```yaml
+apiVersion: provisioning.cattle.io/v1
+kind: Cluster
+spec:
+  [...]
+  rkeConfig:
+    chartValues:
+      harvester-cloud-provider:
+        [...]
+        kube-vip:
+          env:
+            svc_election: 'true'
+      [...]
+      rke2-traefik:
+        service:
+          [...]
+          spec:
+            externalTrafficPolicy: Local
+```
+
+Traefik advanced configuration:
+```yaml
+additionalArguments:
+  - --providers.file.directory=/etc/traefik/dynamic
+  - --providers.file.watch=true
+  - --entryPoints.websecure.transport.respondingTimeouts.readTimeout=300s
+certificatesResolvers:
+  default:
+    acme:
+      dnsChallenge:
+        propagation:
+          delayBeforeChecks: 5m0s
+        provider: cloudflare
+        resolvers:
+          - 1.1.1.1:53
+          - 1.0.0.1:53
+      email: <omitted>
+      storage: /data/acme.json
+deployment:
+  initContainers:
+    - command:
+        - sh
+        - -c
+        - touch /data/acme.json; chown 65532 /data/acme.json; chmod -v 600 /data/acme.json
+      image: busybox:latest
+      name: volume-permissions
+      securityContext:
+        runAsGroup: 0
+        runAsNonRoot: false
+        runAsUser: 0
+      volumeMounts:
+        - mountPath: /data
+          name: traefik-data
+  kind: Deployment
+env:
+  - name: CF_API_EMAIL
+    valueFrom:
+      secretKeyRef:
+        key: CF_API_EMAIL
+        name: traefik-cloudflare
+  - name: CF_API_KEY
+    valueFrom:
+      secretKeyRef:
+        key: CF_API_KEY
+        name: traefik-cloudflare
+extraObjects:
+  - apiVersion: v1
+    data:
+      config.yml: |
+        http:
+          middlewares:
+            2fa-authentication:
+              forwardAuth:
+                address: "https://auth.spamasaurus.com/api/verify?rd=https://auth.spamasaurus.com/"
+                trustForwardHeader: true
+            security-headers:
+              headers:
+                forceSTSHeader: true
+                stsSeconds: 315360000
+                stsIncludeSubdomains: true
+                stsPreload: true
+        tls:
+          options:
+            defaults:
+              minVersion: VersionTLS12
+              sniStrict: false
+              curvePreferences:
+                - secp521r1
+                - secp384r1
+                - secp256r1
+              cipherSuites:
+                - TLS_AES_128_GCM_SHA256
+                - TLS_AES_256_GCM_SHA384
+                - TLS_CHACHA20_POLY1305_SHA256
+                - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+                - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+                - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+                - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+                - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+                - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+                - TLS_FALLBACK_SCSV
+    kind: ConfigMap
+    metadata:
+      name: traefik-file-provider
+      namespace: kube-system
+ingressRoute:
+  dashboard:
+    enabled: true
+    entryPoints:
+      - websecure
+    matchRule: Host(`ingress.lab.spamasaurus.com`)
+    middlewares:
+      - name: 2fa-authentication@file
+      - name: security-headers@file
+logs:
+  general:
+    level: INFO
+persistence:
+  enabled: true
+  name: traefik-data
+ports:
+  web:
+    http:
+      redirections:
+        entryPoint:
+          permanent: true
+          scheme: https
+          to: websecure
+  websecure:
+    forwardedHeaders:
+      insecure: true
+    http:
+      tls:
+        certResolver: default
+        domains:
+          - main: '*.pvr.spamasaurus.com'
+          - main: '*.lab.spamasaurus.com'
+          - main: '*.spamasaurus.com'
+            sans:
+              - spamasaurus.com
+          - main: '*.bessems.com'
+            sans:
+              - bessems.com
+          - main: '*.bessems.eu'
+            sans:
+              - bessems.eu
+          - main: '*.gabaldon.eu'
+            sans:
+              - gabaldon.eu
+          - main: '*.gabaldon.nl'
+            sans:
+              - gabaldon.nl
+          - main: '*.itch.fyi'
+            sans:
+              - itch.fyi
+        options: defaults@file
+providers:
+  kubernetesCRD:
+    ingressClass: ""
+service:
+  annotations:
+    cloudprovider.harvesterhci.io/ip-pool: <ippoolname>
+    cloudprovider.harvesterhci.io/ipam: pool
+  spec:
+    externalTrafficPolicy: Local
+    type: LoadBalancer
+volumes:
+  - mountPath: /etc/traefik/dynamic
+    name: traefik-file-provider
+    type: configMap
+```
 
 ### 2) Persistent storage