premises: add app (base + vad) and route /premises/api/ in vad

New service on universal-chart with Vault Agent: role premises, SA premises-vault, creds for its own postgres, kafka and S3 plus the five neighbour databases the sync script reads. The vad overlay mounts the Kafka CA and drops the prod-sized resource requests; istio-config routes sarex.vadroad.ru/premises/api/ to backend-svc.premises.
2026-10-10 13:25:21 +05:00
19 changed files with 399 additions and 293 deletions
--- a/apps/premises/base/backend.yaml
+++ b/apps/premises/base/backend.yaml
@ -0,0 +1,313 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: premises
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: premises-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/premises-backend:production_216148a9
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: premises-backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/premises-db ] && . /vault/secrets/premises-db
+                [ -f /vault/secrets/premises-kafka ] && . /vault/secrets/premises-kafka
+                [ -f /vault/secrets/premises-s3 ] && . /vault/secrets/premises-s3
+                [ -f /vault/secrets/premises-issues-db ] && . /vault/secrets/premises-issues-db
+                [ -f /vault/secrets/premises-inspections-db ] && . /vault/secrets/premises-inspections-db
+                [ -f /vault/secrets/premises-checklists-db ] && . /vault/secrets/premises-checklists-db
+                [ -f /vault/secrets/premises-eav-db ] && . /vault/secrets/premises-eav-db
+                [ -f /vault/secrets/premises-sarex-db ] && . /vault/secrets/premises-sarex-db
+                [ -f /usr/local/share/ca-certificates/kafka.crt ] && export KAFKA_SSL_CERT="$(cat /usr/local/share/ca-certificates/kafka.crt)"
+                set +a
+                exec ./entrypoint.sh
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 1Gi
+
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              httpGet:
+                path:
+                  _default: /internal/healthz/live/
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 60
+            readiness:
+              enabled:
+                _default: true
+              httpGet:
+                path:
+                  _default: /internal/healthz/ready/
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 30
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: DEBUG
+            value:
+              _default: "false"
+
+          - name: HTTP_ROOT_PATH
+            value:
+              _default: "/premises"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: GUNICORN_WORKERS
+            value:
+              _default: "3"
+
+          - name: FASTSTREAM_WORKERS
+            value:
+              _default: "3"
+
+          - name: DATABASE_POOL_SIZE
+            value:
+              _default: "5"
+
+          - name: KAFKA_EAV_ASSET_TOPIC_NAME
+            value:
+              _default: "assets_broadcast"
+
+          - name: KAFKA_SSL_CERT
+            value:
+              _default: ""
+
+          - name: S3_BUCKET
+            value:
+              _default: "premises"
+
+          - name: EXPORT_TTL_MINUTES
+            value:
+              _default: "30"
+
+          - name: EXPORT_MAX_WORKERS
+            value:
+              _default: "4"
+
+          - name: EXPORT_S3_KEY_PREFIX
+            value:
+              _default: "premise-export"
+
+          - name: ATTACHMENT_MAX_SIZE_BYTES
+            value:
+              _default: "314572800"
+
+          - name: ATTACHMENT_S3_KEY_PREFIX
+            value:
+              _default: "attachment/"
+
+          - name: OTEL_ENABLE
+            value:
+              _default: "false"
+
+          - name: OTEL_URL
+            value:
+              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
+
+          - name: OTEL_SERVICE_NAME
+            value:
+              _default: "premises-backend"
+
+          - name: OTEL_INSECURE
+            value:
+              _default: "true"
+
+          - name: SRX_SDK_IAM_ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.processing.svc.cluster.local:80"
+
+          - name: WORKFLOWS_GENERATION_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/rendering-template:master"
+
+          - name: WORKFLOWS_DOCX_TO_PDF_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/docx-to-pdf:latest"
+
+          - name: WORKFLOWS_CALLBACK_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/webhook-caller:master"
+
+          - name: WORKFLOWS_CALLBACK_HOST
+            value:
+              _default: "http://backend-svc.premises.svc.cluster.local:80"
+
+          - name: WORKFLOWS_RESULT_PATH
+            value:
+              _default: "premises-prod"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: premises
+            vault.hashicorp.com/agent-inject-secret-premises-db: secrets/data/apps/premises/postgres
+            vault.hashicorp.com/agent-inject-template-premises-db: |-
+              {{- with secret "secrets/data/apps/premises/postgres" -}}
+              DATABASE_HOST={{ index .Data.data "host" }}
+              DATABASE_PORT={{ index .Data.data "port" }}
+              DATABASE_NAME={{ index .Data.data "database" }}
+              DATABASE_USERNAME={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-kafka: secrets/data/kafka/apps/premises
+            vault.hashicorp.com/agent-inject-template-premises-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/premises" -}}
+              KAFKA_HOST={{ if .Data.data.auth }}{{ index .Data.data.auth "bootstrap_servers" }}{{ else }}{{ index .Data.data "bootstrap_servers" }}{{ end }}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-s3: secrets/data/minio/apps/premises
+            vault.hashicorp.com/agent-inject-template-premises-s3: |-
+              {{- with secret "secrets/data/minio/apps/premises" -}}
+              S3_HOST={{ index .Data.data.client "endpoint" }}
+              S3_ACCESS_KEY={{ index .Data.data "access_key" }}
+              S3_SECRET_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-issues-db: secrets/data/apps/issues/postgres
+            vault.hashicorp.com/agent-inject-template-premises-issues-db: |-
+              {{- with secret "secrets/data/apps/issues/postgres" -}}
+              ISSUES_DATABASE_HOST={{ index .Data.data "host" }}
+              ISSUES_DATABASE_PORT={{ index .Data.data "port" }}
+              ISSUES_DATABASE_NAME={{ index .Data.data "database" }}
+              ISSUES_DATABASE_USERNAME={{ index .Data.data "username" }}
+              ISSUES_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-inspections-db: secrets/data/apps/inspections/postgres
+            vault.hashicorp.com/agent-inject-template-premises-inspections-db: |-
+              {{- with secret "secrets/data/apps/inspections/postgres" -}}
+              INSPECTIONS_DATABASE_HOST={{ index .Data.data "host" }}
+              INSPECTIONS_DATABASE_PORT={{ index .Data.data "port" }}
+              INSPECTIONS_DATABASE_NAME={{ index .Data.data "database" }}
+              INSPECTIONS_DATABASE_USERNAME={{ index .Data.data "username" }}
+              INSPECTIONS_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-checklists-db: secrets/data/apps/checklists/postgres
+            vault.hashicorp.com/agent-inject-template-premises-checklists-db: |-
+              {{- with secret "secrets/data/apps/checklists/postgres" -}}
+              CHECKLISTS_DATABASE_HOST={{ index .Data.data "host" }}
+              CHECKLISTS_DATABASE_PORT={{ index .Data.data "port" }}
+              CHECKLISTS_DATABASE_NAME={{ index .Data.data "database" }}
+              CHECKLISTS_DATABASE_USERNAME={{ index .Data.data "username" }}
+              CHECKLISTS_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-eav-db: secrets/data/apps/eav/postgres
+            vault.hashicorp.com/agent-inject-template-premises-eav-db: |-
+              {{- with secret "secrets/data/apps/eav/postgres" -}}
+              EAV_DATABASE_HOST={{ index .Data.data "host" }}
+              EAV_DATABASE_PORT={{ index .Data.data "port" }}
+              EAV_DATABASE_NAME={{ index .Data.data "database" }}
+              EAV_DATABASE_USERNAME={{ index .Data.data "username" }}
+              EAV_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-sarex-db: secrets/data/apps/django/postgres
+            vault.hashicorp.com/agent-inject-template-premises-sarex-db: |-
+              {{- with secret "secrets/data/apps/django/postgres" -}}
+              SAREX_DATABASE_HOST={{ index .Data.data "host" }}
+              SAREX_DATABASE_PORT={{ index .Data.data "port" }}
+              SAREX_DATABASE_NAME={{ index .Data.data "database" }}
+              SAREX_DATABASE_USERNAME={{ index .Data.data "username" }}
+              SAREX_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""
--- a/apps/premises/base/kustomization.yaml
+++ b/apps/premises/base/kustomization.yaml
@ -1,6 +1,7 @@
+---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: premises
 resources:
-  - ./flux-system
-  - ./helm-repositories.yaml
-  - ./infrastructure
+  - namespace.yaml
+  - backend.yaml
--- a/apps/premises/base/namespace.yaml
+++ b/apps/premises/base/namespace.yaml
@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: premises
+  labels:
+    istio-injection: enabled
--- a/apps/premises/vad/backend.yaml
+++ b/apps/premises/vad/backend.yaml
@ -0,0 +1,31 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: premises
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        volumes:
+          _default:
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-ca-cert
+                items:
+                  - key: kafka.crt
+                    path:
+                      _default: kafka.crt
--- a/apps/premises/vad/kafka-ca-configmap.yaml
+++ b/apps/premises/vad/kafka-ca-configmap.yaml
@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: premises
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+    0FC16VuidLG0HUCCawFjRiAg9rIA
+    -----END CERTIFICATE-----
--- a/infrastructure/istio-pilot/vk-infra/kustomization.yaml
+++ b/infrastructure/istio-pilot/vk-infra/kustomization.yaml
@ -2,11 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+  - kafka-ca-configmap.yaml
 patches:
-  - path: ./istio-pilot.yaml
+  - path: backend.yaml
    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
      kind: HelmRelease
-      name: istiod
-      namespace: istio-system
+      name: backend
--- a/clusters/vad/kustomization.yaml
+++ b/clusters/vad/kustomization.yaml
@ -52,3 +52,4 @@ resources:
  - ../../apps/pm/vad
  - ../../apps/message-hub/vad
  - ../../apps/cde/vad
+  - ../../apps/premises/vad
--- a/clusters/vk-infra/flux-system/kustomization.yaml
+++ b/clusters/vk-infra/flux-system/kustomization.yaml
@ -1,45 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- gotk-components.yaml
- gotk-sync.yaml
-patches:
- target:
-    kind: Deployment
-    name: (source-controller|kustomize-controller|helm-controller|notification-controller)
-  patch: |
-    - op: add
-      path: /spec/template/spec/nodeSelector/sarex.io~1pool
-      value: svc
- target:
-    kind: Deployment
-    name: kustomize-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/template/spec/topologySpreadConstraints
-      value:
-        - maxSkew: 1
-          topologyKey: topology.kubernetes.io/zone
-          whenUnsatisfiable: DoNotSchedule
-          labelSelector:
-            matchLabels:
-              app: kustomize-controller
- target:
-    kind: Deployment
-    name: helm-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/template/spec/topologySpreadConstraints
-      value:
-        - maxSkew: 1
-          topologyKey: topology.kubernetes.io/zone
-          whenUnsatisfiable: DoNotSchedule
-          labelSelector:
-            matchLabels:
-              app: helm-controller
--- a/clusters/vk-infra/helm-repositories.yaml
+++ b/clusters/vk-infra/helm-repositories.yaml
@ -1,11 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: yc-oci-charts
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
-  secretRef:
-    name: yc-cr-auth
--- a/clusters/vk-infra/infrastructure/kustomization.yaml
+++ b/clusters/vk-infra/infrastructure/kustomization.yaml
@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../../infrastructure/istio-base/vk-infra
-  - ../../../infrastructure/istio-pilot/vk-infra
-  - ../../../infrastructure/istio-gateway/vk-infra
--- a/infrastructure/istio-base/vk-infra/istio-base.yaml
+++ b/infrastructure/istio-base/vk-infra/istio-base.yaml
@ -1,14 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: istio-base
-  namespace: istio-system
-spec:
-  chart:
-    spec:
-      chart: base-infra
-      version: "1.30.5"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
--- a/infrastructure/istio-base/vk-infra/kustomization.yaml
+++ b/infrastructure/istio-base/vk-infra/kustomization.yaml
@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: ./istio-base.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: istio-base
-      namespace: istio-system
--- a/infrastructure/istio-config/vad/istio-config.yaml
+++ b/infrastructure/istio-config/vad/istio-config.yaml
@ -335,6 +335,19 @@ spec:
                  rewrite: /api/
                  service: backend-svc.inspections.svc.cluster.local
                  port: 80
+            premises-api:
+              name: premises-api-virt-service
+              namespace: default
+              hosts:
+                - sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /premises/api/
+                  rewrite: /api/
+                  service: backend-svc.premises.svc.cluster.local
+                  port: 80
            reviews-frontend:
              name: reviews-frontend-virt-service
              namespace: default
--- a/infrastructure/istio-gateway/vk-infra/ingressgateway-me1.yaml
+++ b/infrastructure/istio-gateway/vk-infra/ingressgateway-me1.yaml
@ -1,43 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: ingressgateway-me1
-  namespace: istio-system
-spec:
-  interval: 10m
-  dependsOn:
-    - name: istio-base
-      namespace: istio-system
-    - name: istiod
-      namespace: istio-system
-  chart:
-    spec:
-      chart: gateway-infra
-      version: "1.30.5"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    name: istio-ingressgateway-me1
-    labels:
-      app: istio-ingressgateway
-      istio: ingressgateway
-    replicaCount: 1
-    autoscaling:
-      enabled: false
-    nodeSelector:
-      sarex.io/pool: svc
-      topology.kubernetes.io/zone: ME1
-    imagePullSecrets:
-      - name: istio-registry-secret
-    service:
-      type: ClusterIP
-      externalTrafficPolicy: ""
--- a/infrastructure/istio-gateway/vk-infra/ingressgateway-ms1.yaml
+++ b/infrastructure/istio-gateway/vk-infra/ingressgateway-ms1.yaml
@ -1,43 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: ingressgateway-ms1
-  namespace: istio-system
-spec:
-  interval: 10m
-  dependsOn:
-    - name: istio-base
-      namespace: istio-system
-    - name: istiod
-      namespace: istio-system
-  chart:
-    spec:
-      chart: gateway-infra
-      version: "1.30.5"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    name: istio-ingressgateway-ms1
-    labels:
-      app: istio-ingressgateway
-      istio: ingressgateway
-    replicaCount: 1
-    autoscaling:
-      enabled: false
-    nodeSelector:
-      sarex.io/pool: svc
-      topology.kubernetes.io/zone: MS1
-    imagePullSecrets:
-      - name: istio-registry-secret
-    service:
-      type: ClusterIP
-      externalTrafficPolicy: ""
--- a/infrastructure/istio-gateway/vk-infra/ingressgateway-pa2.yaml
+++ b/infrastructure/istio-gateway/vk-infra/ingressgateway-pa2.yaml
@ -1,43 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: ingressgateway-pa2
-  namespace: istio-system
-spec:
-  interval: 10m
-  dependsOn:
-    - name: istio-base
-      namespace: istio-system
-    - name: istiod
-      namespace: istio-system
-  chart:
-    spec:
-      chart: gateway-infra
-      version: "1.30.5"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    name: istio-ingressgateway-pa2
-    labels:
-      app: istio-ingressgateway
-      istio: ingressgateway
-    replicaCount: 1
-    autoscaling:
-      enabled: false
-    nodeSelector:
-      sarex.io/pool: svc
-      topology.kubernetes.io/zone: PA2
-    imagePullSecrets:
-      - name: istio-registry-secret
-    service:
-      type: ClusterIP
-      externalTrafficPolicy: ""
--- a/infrastructure/istio-gateway/vk-infra/kustomization.yaml
+++ b/infrastructure/istio-gateway/vk-infra/kustomization.yaml
@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./ingressgateway-pa2.yaml
-  - ./ingressgateway-me1.yaml
-  - ./ingressgateway-ms1.yaml
-  - ./lb-service.yaml
--- a/infrastructure/istio-gateway/vk-infra/lb-service.yaml
+++ b/infrastructure/istio-gateway/vk-infra/lb-service.yaml
@ -1,27 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: istio-ingressgateway
-  namespace: istio-system
-  labels:
-    app: istio-ingressgateway
-    istio: ingressgateway
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  selector:
-    app: istio-ingressgateway
-    istio: ingressgateway
-  ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
--- a/infrastructure/istio-pilot/vk-infra/istio-pilot.yaml
+++ b/infrastructure/istio-pilot/vk-infra/istio-pilot.yaml
@ -1,34 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: istiod
-  namespace: istio-system
-spec:
-  chart:
-    spec:
-      chart: istiod-infra
-      version: "1.30.5"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-  values:
-    replicaCount: 3
-    autoscaleEnabled: false
-    nodeSelector:
-      sarex.io/pool: svc
-    topologySpreadConstraints:
-      - maxSkew: 1
-        topologyKey: topology.kubernetes.io/zone
-        whenUnsatisfiable: DoNotSchedule
-        labelSelector:
-          matchLabels:
-            app: istiod
-            istio: pilot
-    global:
-      hub: cr.yandex/crp3ccidau046kdj8g9q/istio
-      tag: 1.30.5-amd64
-      imagePullSecrets:
-        - istio-registry-secret
-    pilot:
-      traceSampling: 100