From b7e7fc1c72dc891efb368a28a853ddda355d7eaa Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Mon, 2 Nov 2026 12:30:11 +0500
Subject: [PATCH] =?UTF-8?q?uralkal:=20drift=20detection=20=D0=B4=D0=BB?=
 =?UTF-8?q?=D1=8F=20=D0=B2=D1=81=D0=B5=D1=85=20HelmRelease=20(=D0=BF.39,?=
 =?UTF-8?q?=20INFRA-3058)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

driftDetection.mode: enabled патчем в clusters/uralkal/kustomization.yaml,
base и другие контуры не затронуты. Исключены webhooks в
Mutating/ValidatingWebhookConfiguration (caBundle пишут vault-injector и
istiod) и /spec/replicas Deployment у istiod (HPA istio-system/istiod).
Kustomization flux-system уже prune: true, interval: 10m.
---
 clusters/uralkal/kustomization.yaml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/clusters/uralkal/kustomization.yaml b/clusters/uralkal/kustomization.yaml
index f4b8e57..6755dd4 100644
--- a/clusters/uralkal/kustomization.yaml
+++ b/clusters/uralkal/kustomization.yaml
@@ -55,3 +55,29 @@ resources:
   - ../../apps/message-hub/uralkal
   - ../../apps/cde/uralkal
 
+patches:
+  - target:
+      kind: HelmRelease
+    patch: |
+      - op: add
+        path: /spec/driftDetection
+        value:
+          mode: enabled
+          ignore:
+            - paths: ["/webhooks"]
+              target:
+                kind: MutatingWebhookConfiguration
+            - paths: ["/webhooks"]
+              target:
+                kind: ValidatingWebhookConfiguration
+  - target:
+      kind: HelmRelease
+      name: istiod
+    patch: |
+      - op: add
+        path: /spec/driftDetection/ignore/-
+        value:
+          paths: ["/spec/replicas"]
+          target:
+            kind: Deployment
+