diff --git a/pkg/model/components/cilium.go b/pkg/model/components/cilium.go
index c24b74b855..f7b8274e56 100644
--- a/pkg/model/components/cilium.go
+++ b/pkg/model/components/cilium.go
@@ -173,21 +173,6 @@ func (b *CiliumOptionsBuilder) BuildOptions(o interface{}) error {
 		if ingress.Enabled == nil {
 			ingress.Enabled = fi.PtrTo(true)
 		}
-		if ingress.EnforceHttps == nil {
-			ingress.EnforceHttps = fi.PtrTo(true)
-		}
-		if ingress.EnableSecretsSync == nil {
-			ingress.EnableSecretsSync = fi.PtrTo(true)
-		}
-		if ingress.LoadBalancerAnnotationPrefixes == "" {
-			ingress.LoadBalancerAnnotationPrefixes = "service.beta.kubernetes.io service.kubernetes.io cloud.google.com"
-		}
-		if ingress.DefaultLoadBalancerMode == "" {
-			ingress.DefaultLoadBalancerMode = "dedicated"
-		}
-		if ingress.SharedLoadBalancerServiceName == "" {
-			ingress.SharedLoadBalancerServiceName = "cilium-ingress"
-		}
 	} else {
 		c.Ingress = &kops.CiliumIngressSpec{
 			Enabled: fi.PtrTo(false),
diff --git a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.13.yaml.template b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.13.yaml.template
index 954b6658c1..9fdf97a4e0 100644
--- a/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.13.yaml.template
+++ b/upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.13.yaml.template
@@ -282,14 +282,29 @@ data:
   enable-envoy-config: "true"
   external-envoy-proxy: "false"
   enable-ingress-controller: "true"
-  enforce-ingress-https: "{{ .Ingress.EnforceHttps }}"
-  enable-ingress-secrets-sync: "{{ .Ingress.EnableSecretsSync }}"
   ingress-secrets-namespace: kube-system
-  ingress-lb-annotation-prefixes: "{{ .Ingress.LoadBalancerAnnotationPrefixes }}"
-  ingress-default-lb-mode: {{ .Ingress.DefaultLoadBalancerMode }}
+
+  {{ if .Ingress.EnforceHttps }}
+  enforce-ingress-https: "{{ .Ingress.EnforceHttps }}"
+  {{ end }}
+
+  {{ if .Ingress.EnableSecretsSync }}
+  enable-ingress-secrets-sync: "{{ .Ingress.EnableSecretsSync }}"
+  {{ end }}
+
+  {{ if .Ingress.SharedLoadBalancerServiceName }}
   ingress-shared-lb-service-name: {{ .Ingress.SharedLoadBalancerServiceName }}
   {{ end }}
 
+  {{ if .Ingress.DefaultLoadBalancerMode }}
+  ingress-default-lb-mode: {{ .Ingress.DefaultLoadBalancerMode }}
+  {{ end }}
+
+  {{ if .Ingress.LoadBalancerAnnotationPrefixes }}
+  ingress-lb-annotation-prefixes: "{{ .Ingress.LoadBalancerAnnotationPrefixes }}"
+  {{ end }}
+  {{ end }}
+
   {{ if WithDefaultBool .Hubble.Enabled false }}
   # Enable Hubble gRPC service.
   enable-hubble: "true"
@@ -711,6 +726,15 @@ subjects:
     name: "cilium-operator"
     namespace: kube-system
 ---
+# Source: cilium/templates/cilium-ingress-class.yaml
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  name: cilium
+spec:
+  controller: cilium.io/ingress-controller
+{{ if or (eq .Ingress.DefaultLoadBalancerMode "shared") (not .Ingress.DefaultLoadBalancerMode) }}
+---
 # Source: cilium/templates/cilium-ingress-service.yaml
 apiVersion: v1
 kind: Service
@@ -742,14 +766,7 @@ subsets:
   - ip: "192.192.192.192"
   ports:
   - port: 9999
----
-# Source: cilium/templates/cilium-ingress-class.yaml
-apiVersion: networking.k8s.io/v1
-kind: IngressClass
-metadata:
-  name: cilium
-spec:
-  controller: cilium.io/ingress-controller
+{{ end }}
 {{ end }}
 {{ if WithDefaultBool .Hubble.Enabled false }}
 ---