diff --git a/clusters/stand/10-mesh/kustomization.yaml b/clusters/stand/10-mesh/kustomization.yaml
new file mode 100644
index 0000000..64e7f7d
--- /dev/null
+++ b/clusters/stand/10-mesh/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-base/contour-template
+  - ../../../infrastructure/istio-pilot/contour-template
+  - ../../../infrastructure/istio-gateway/contour-template
+  - ../../../infrastructure/cert-manager/contour-template
diff --git a/clusters/stand/layers.yaml b/clusters/stand/layers.yaml
index 5715606..e5f1592 100644
--- a/clusters/stand/layers.yaml
+++ b/clusters/stand/layers.yaml
@@ -15,3 +15,22 @@ spec:
     substituteFrom:
       - kind: ConfigMap
         name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 10-mesh
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 15m0s
+  path: ./clusters/stand/10-mesh
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars
diff --git a/infrastructure/cert-manager/contour-template/kustomization.yaml b/infrastructure/cert-manager/contour-template/kustomization.yaml
new file mode 100644
index 0000000..f2c19d1
--- /dev/null
+++ b/infrastructure/cert-manager/contour-template/kustomization.yaml
@@ -0,0 +1,27 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer-istio
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer-istio
diff --git a/infrastructure/istio-base/contour-template/kustomization.yaml b/infrastructure/istio-base/contour-template/kustomization.yaml
new file mode 100644
index 0000000..27bb5cb
--- /dev/null
+++ b/infrastructure/istio-base/contour-template/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
diff --git a/infrastructure/istio-gateway/contour-template/istio-gateway.yaml b/infrastructure/istio-gateway/contour-template/istio-gateway.yaml
new file mode 100644
index 0000000..c904f81
--- /dev/null
+++ b/infrastructure/istio-gateway/contour-template/istio-gateway.yaml
@@ -0,0 +1,31 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  values:
+    _internal_defaults_do_not_set:
+      replicaCount: ${GATEWAY_REPLICAS}
+      service:
+        type: ClusterIP
+      nodeSelector:
+        sarex.io/gateway: "true"
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  istio: ingressgateway
+              topologyKey: kubernetes.io/hostname
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
diff --git a/infrastructure/istio-gateway/contour-template/kustomization.yaml b/infrastructure/istio-gateway/contour-template/kustomization.yaml
new file mode 100644
index 0000000..ecc3c36
--- /dev/null
+++ b/infrastructure/istio-gateway/contour-template/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-gateway.yaml
diff --git a/infrastructure/istio-pilot/contour-template/istio-pilot.yaml b/infrastructure/istio-pilot/contour-template/istio-pilot.yaml
new file mode 100644
index 0000000..7aca72a
--- /dev/null
+++ b/infrastructure/istio-pilot/contour-template/istio-pilot.yaml
@@ -0,0 +1,12 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istiod
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      imagePullSecrets:
+        - regcred
diff --git a/infrastructure/istio-pilot/contour-template/kustomization.yaml b/infrastructure/istio-pilot/contour-template/kustomization.yaml
new file mode 100644
index 0000000..252e659
--- /dev/null
+++ b/infrastructure/istio-pilot/contour-template/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-pilot.yaml