From 31cfdca386dc552e2901273c254d777a8e5bbc44 Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Wed, 8 Apr 2026 17:52:16 +0300
Subject: [PATCH] istio: enforce base-first rollout and fix kustomize overlays

---
 infrastructure/istio-base/base/kustomization.yaml    | 3 +--
 infrastructure/istio-gateway/base/helmrelease.yaml   | 5 ++++-
 infrastructure/istio-gateway/base/kustomization.yaml | 4 +---
 infrastructure/istio-pilot/base/helmrelease.yaml     | 5 ++++-
 infrastructure/istio-pilot/base/kustomization.yaml   | 4 +---
 5 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/infrastructure/istio-base/base/kustomization.yaml b/infrastructure/istio-base/base/kustomization.yaml
index 69a5e51..0370974 100644
--- a/infrastructure/istio-base/base/kustomization.yaml
+++ b/infrastructure/istio-base/base/kustomization.yaml
@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cert-manager
 resources:
   - namespace.yaml
-  - helmrelease.yaml
\ No newline at end of file
+  - helmrelease.yaml
diff --git a/infrastructure/istio-gateway/base/helmrelease.yaml b/infrastructure/istio-gateway/base/helmrelease.yaml
index 0edeece..06d41d1 100644
--- a/infrastructure/istio-gateway/base/helmrelease.yaml
+++ b/infrastructure/istio-gateway/base/helmrelease.yaml
@@ -5,6 +5,9 @@ metadata:
   namespace: istio-system
 spec:
   interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
   chart:
     spec:
       chart: istio-gateway-contour
@@ -19,4 +22,4 @@ spec:
       retries: 3
   upgrade:
     remediation:
-      retries: 3
\ No newline at end of file
+      retries: 3
diff --git a/infrastructure/istio-gateway/base/kustomization.yaml b/infrastructure/istio-gateway/base/kustomization.yaml
index 69a5e51..4fd939d 100644
--- a/infrastructure/istio-gateway/base/kustomization.yaml
+++ b/infrastructure/istio-gateway/base/kustomization.yaml
@@ -1,6 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cert-manager
 resources:
-  - namespace.yaml
-  - helmrelease.yaml
\ No newline at end of file
+  - helmrelease.yaml
diff --git a/infrastructure/istio-pilot/base/helmrelease.yaml b/infrastructure/istio-pilot/base/helmrelease.yaml
index 5465e30..7eee7bc 100644
--- a/infrastructure/istio-pilot/base/helmrelease.yaml
+++ b/infrastructure/istio-pilot/base/helmrelease.yaml
@@ -5,6 +5,9 @@ metadata:
   namespace: istio-system
 spec:
   interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
   chart:
     spec:
       chart: istiod-contour
@@ -19,4 +22,4 @@ spec:
       retries: 3
   upgrade:
     remediation:
-      retries: 3
\ No newline at end of file
+      retries: 3
diff --git a/infrastructure/istio-pilot/base/kustomization.yaml b/infrastructure/istio-pilot/base/kustomization.yaml
index 69a5e51..4fd939d 100644
--- a/infrastructure/istio-pilot/base/kustomization.yaml
+++ b/infrastructure/istio-pilot/base/kustomization.yaml
@@ -1,6 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cert-manager
 resources:
-  - namespace.yaml
-  - helmrelease.yaml
\ No newline at end of file
+  - helmrelease.yaml