++ vk infra istio 1.30.5

apps/premises/base/backend.yaml

@@ -1,313 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.9"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        serviceAccount:
-          enabled:
-            _default: true
-          name:
-            _default: premises-vault
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/premises-backend:production_216148a9
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: premises-backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          command:
-            _default: ["/bin/sh", "-ec"]
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/premises-db ] && . /vault/secrets/premises-db
-                [ -f /vault/secrets/premises-kafka ] && . /vault/secrets/premises-kafka
-                [ -f /vault/secrets/premises-s3 ] && . /vault/secrets/premises-s3
-                [ -f /vault/secrets/premises-issues-db ] && . /vault/secrets/premises-issues-db
-                [ -f /vault/secrets/premises-inspections-db ] && . /vault/secrets/premises-inspections-db
-                [ -f /vault/secrets/premises-checklists-db ] && . /vault/secrets/premises-checklists-db
-                [ -f /vault/secrets/premises-eav-db ] && . /vault/secrets/premises-eav-db
-                [ -f /vault/secrets/premises-sarex-db ] && . /vault/secrets/premises-sarex-db
-                [ -f /usr/local/share/ca-certificates/kafka.crt ] && export KAFKA_SSL_CERT="$(cat /usr/local/share/ca-certificates/kafka.crt)"
-                set +a
-                exec ./entrypoint.sh
-
-          resources:
-            requests:
-              cpu:
-                _default: "1"
-              memory:
-                _default: 1Gi
-
-          probes:
-            liveness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/live/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 60
-            readiness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/ready/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 30
-
-        service:
-          enabled: true
-
-          name:
-            _default: backend-svc
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: regcred
-
-        envs:
-          - name: DEBUG
-            value:
-              _default: "false"
-
-          - name: HTTP_ROOT_PATH
-            value:
-              _default: "/premises"
-
-          - name: JWT_AUTH_ENABLE
-            value:
-              _default: "true"
-
-          - name: GUNICORN_WORKERS
-            value:
-              _default: "3"
-
-          - name: FASTSTREAM_WORKERS
-            value:
-              _default: "3"
-
-          - name: DATABASE_POOL_SIZE
-            value:
-              _default: "5"
-
-          - name: KAFKA_EAV_ASSET_TOPIC_NAME
-            value:
-              _default: "assets_broadcast"
-
-          - name: KAFKA_SSL_CERT
-            value:
-              _default: ""
-
-          - name: S3_BUCKET
-            value:
-              _default: "premises"
-
-          - name: EXPORT_TTL_MINUTES
-            value:
-              _default: "30"
-
-          - name: EXPORT_MAX_WORKERS
-            value:
-              _default: "4"
-
-          - name: EXPORT_S3_KEY_PREFIX
-            value:
-              _default: "premise-export"
-
-          - name: ATTACHMENT_MAX_SIZE_BYTES
-            value:
-              _default: "314572800"
-
-          - name: ATTACHMENT_S3_KEY_PREFIX
-            value:
-              _default: "attachment/"
-
-          - name: OTEL_ENABLE
-            value:
-              _default: "false"
-
-          - name: OTEL_URL
-            value:
-              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
-
-          - name: OTEL_SERVICE_NAME
-            value:
-              _default: "premises-backend"
-
-          - name: OTEL_INSECURE
-            value:
-              _default: "true"
-
-          - name: SRX_SDK_IAM_ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
-
-          - name: WORKFLOWS_GENERATION_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/rendering-template:master"
-
-          - name: WORKFLOWS_DOCX_TO_PDF_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/docx-to-pdf:latest"
-
-          - name: WORKFLOWS_CALLBACK_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/webhook-caller:master"
-
-          - name: WORKFLOWS_CALLBACK_HOST
-            value:
-              _default: "http://backend-svc.premises.svc.cluster.local:80"
-
-          - name: WORKFLOWS_RESULT_PATH
-            value:
-              _default: "premises-prod"
-
-        podAnnotations:
-          _default:
-            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-            vault.hashicorp.com/agent-init-first: "true"
-            vault.hashicorp.com/agent-inject: "true"
-            vault.hashicorp.com/agent-pre-populate-only: "true"
-            vault.hashicorp.com/auth-path: auth/kubernetes
-            vault.hashicorp.com/role: premises
-            vault.hashicorp.com/agent-inject-secret-premises-db: secrets/data/apps/premises/postgres
-            vault.hashicorp.com/agent-inject-template-premises-db: |-
-              {{- with secret "secrets/data/apps/premises/postgres" -}}
-              DATABASE_HOST={{ index .Data.data "host" }}
-              DATABASE_PORT={{ index .Data.data "port" }}
-              DATABASE_NAME={{ index .Data.data "database" }}
-              DATABASE_USERNAME={{ index .Data.data "username" }}
-              DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-kafka: secrets/data/kafka/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-kafka: |-
-              {{- with secret "secrets/data/kafka/apps/premises" -}}
-              KAFKA_HOST={{ if .Data.data.auth }}{{ index .Data.data.auth "bootstrap_servers" }}{{ else }}{{ index .Data.data "bootstrap_servers" }}{{ end }}
-              KAFKA_USERNAME={{ index .Data.data "username" }}
-              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-s3: secrets/data/minio/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-s3: |-
-              {{- with secret "secrets/data/minio/apps/premises" -}}
-              S3_HOST={{ index .Data.data.client "endpoint" }}
-              S3_ACCESS_KEY={{ index .Data.data "access_key" }}
-              S3_SECRET_KEY={{ index .Data.data "secret_key" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-issues-db: secrets/data/apps/issues/postgres
-            vault.hashicorp.com/agent-inject-template-premises-issues-db: |-
-              {{- with secret "secrets/data/apps/issues/postgres" -}}
-              ISSUES_DATABASE_HOST={{ index .Data.data "host" }}
-              ISSUES_DATABASE_PORT={{ index .Data.data "port" }}
-              ISSUES_DATABASE_NAME={{ index .Data.data "database" }}
-              ISSUES_DATABASE_USERNAME={{ index .Data.data "username" }}
-              ISSUES_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-inspections-db: secrets/data/apps/inspections/postgres
-            vault.hashicorp.com/agent-inject-template-premises-inspections-db: |-
-              {{- with secret "secrets/data/apps/inspections/postgres" -}}
-              INSPECTIONS_DATABASE_HOST={{ index .Data.data "host" }}
-              INSPECTIONS_DATABASE_PORT={{ index .Data.data "port" }}
-              INSPECTIONS_DATABASE_NAME={{ index .Data.data "database" }}
-              INSPECTIONS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              INSPECTIONS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-checklists-db: secrets/data/apps/checklists/postgres
-            vault.hashicorp.com/agent-inject-template-premises-checklists-db: |-
-              {{- with secret "secrets/data/apps/checklists/postgres" -}}
-              CHECKLISTS_DATABASE_HOST={{ index .Data.data "host" }}
-              CHECKLISTS_DATABASE_PORT={{ index .Data.data "port" }}
-              CHECKLISTS_DATABASE_NAME={{ index .Data.data "database" }}
-              CHECKLISTS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              CHECKLISTS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-eav-db: secrets/data/apps/eav/postgres
-            vault.hashicorp.com/agent-inject-template-premises-eav-db: |-
-              {{- with secret "secrets/data/apps/eav/postgres" -}}
-              EAV_DATABASE_HOST={{ index .Data.data "host" }}
-              EAV_DATABASE_PORT={{ index .Data.data "port" }}
-              EAV_DATABASE_NAME={{ index .Data.data "database" }}
-              EAV_DATABASE_USERNAME={{ index .Data.data "username" }}
-              EAV_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-sarex-db: secrets/data/apps/django/postgres
-            vault.hashicorp.com/agent-inject-template-premises-sarex-db: |-
-              {{- with secret "secrets/data/apps/django/postgres" -}}
-              SAREX_DATABASE_HOST={{ index .Data.data "host" }}
-              SAREX_DATABASE_PORT={{ index .Data.data "port" }}
-              SAREX_DATABASE_NAME={{ index .Data.data "database" }}
-              SAREX_DATABASE_USERNAME={{ index .Data.data "username" }}
-              SAREX_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/premises/base/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: premises
-  labels:
-    istio-injection: enabled

apps/premises/vad/backend.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        volumes:
-          _default:
-            - name: kafka-ca-cert
-              mountPath:
-                _default: /usr/local/share/ca-certificates/kafka.crt
-              subPath:
-                _default: kafka.crt
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
-                items:
-                  - key: kafka.crt
-                    path:
-                      _default: kafka.crt

apps/premises/vad/kafka-ca-configmap.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-ca-cert
-  namespace: premises
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-    0FC16VuidLG0HUCCawFjRiAg9rIA
-    -----END CERTIFICATE-----

clusters/vad/kustomization.yaml

@@ -52,4 +52,3 @@ resources:
   - ../../apps/pm/vad
   - ../../apps/message-hub/vad
   - ../../apps/cde/vad
-  - ../../apps/premises/vad

clusters/vk-infra/flux-system/kustomization.yaml

@@ -0,0 +1,45 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml
+patches:
+- target:
+    kind: Deployment
+    name: (source-controller|kustomize-controller|helm-controller|notification-controller)
+  patch: |
+    - op: add
+      path: /spec/template/spec/nodeSelector/sarex.io~1pool
+      value: svc
+- target:
+    kind: Deployment
+    name: kustomize-controller
+  patch: |
+    - op: replace
+      path: /spec/replicas
+      value: 3
+    - op: add
+      path: /spec/template/spec/topologySpreadConstraints
+      value:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app: kustomize-controller
+- target:
+    kind: Deployment
+    name: helm-controller
+  patch: |
+    - op: replace
+      path: /spec/replicas
+      value: 3
+    - op: add
+      path: /spec/template/spec/topologySpreadConstraints
+      value:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app: helm-controller

clusters/vk-infra/helm-repositories.yaml

@@ -0,0 +1,11 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: yc-oci-charts
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 10m0s
+  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  secretRef:
+    name: yc-cr-auth

clusters/vk-infra/infrastructure/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-base/vk-infra
+  - ../../../infrastructure/istio-pilot/vk-infra
+  - ../../../infrastructure/istio-gateway/vk-infra

clusters/vk-infra/kustomization.yaml

@@ -1,7 +1,6 @@
----
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: premises
 resources:
-  - namespace.yaml
+  - ./flux-system
-  - backend.yaml
+  - ./helm-repositories.yaml
+  - ./infrastructure

infrastructure/istio-base/vk-infra/istio-base.yaml

@@ -0,0 +1,14 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-base
+  namespace: istio-system
+spec:
+  chart:
+    spec:
+      chart: base-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system

infrastructure/istio-base/vk-infra/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-base.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-base
+      namespace: istio-system

infrastructure/istio-config/vad/istio-config.yaml

@@ -335,19 +335,6 @@ spec:
                   rewrite: /api/
                   service: backend-svc.inspections.svc.cluster.local
                   port: 80
-            premises-api:
-              name: premises-api-virt-service
-              namespace: default
-              hosts:
-                - sarex.vadroad.ru
-              gateways:
-                - default/platform-gateway
-              routes:
-                - path:
-                    prefix: /premises/api/
-                  rewrite: /api/
-                  service: backend-svc.premises.svc.cluster.local
-                  port: 80
             reviews-frontend:
               name: reviews-frontend-virt-service
               namespace: default

infrastructure/istio-gateway/vk-infra/ingressgateway-me1.yaml

@@ -0,0 +1,43 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway-me1
+  namespace: istio-system
+spec:
+  interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: gateway-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    name: istio-ingressgateway-me1
+    labels:
+      app: istio-ingressgateway
+      istio: ingressgateway
+    replicaCount: 1
+    autoscaling:
+      enabled: false
+    nodeSelector:
+      sarex.io/pool: svc
+      topology.kubernetes.io/zone: ME1
+    imagePullSecrets:
+      - name: istio-registry-secret
+    service:
+      type: ClusterIP
+      externalTrafficPolicy: ""

infrastructure/istio-gateway/vk-infra/ingressgateway-ms1.yaml

@@ -0,0 +1,43 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway-ms1
+  namespace: istio-system
+spec:
+  interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: gateway-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    name: istio-ingressgateway-ms1
+    labels:
+      app: istio-ingressgateway
+      istio: ingressgateway
+    replicaCount: 1
+    autoscaling:
+      enabled: false
+    nodeSelector:
+      sarex.io/pool: svc
+      topology.kubernetes.io/zone: MS1
+    imagePullSecrets:
+      - name: istio-registry-secret
+    service:
+      type: ClusterIP
+      externalTrafficPolicy: ""

infrastructure/istio-gateway/vk-infra/ingressgateway-pa2.yaml

@@ -0,0 +1,43 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway-pa2
+  namespace: istio-system
+spec:
+  interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: gateway-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    name: istio-ingressgateway-pa2
+    labels:
+      app: istio-ingressgateway
+      istio: ingressgateway
+    replicaCount: 1
+    autoscaling:
+      enabled: false
+    nodeSelector:
+      sarex.io/pool: svc
+      topology.kubernetes.io/zone: PA2
+    imagePullSecrets:
+      - name: istio-registry-secret
+    service:
+      type: ClusterIP
+      externalTrafficPolicy: ""

infrastructure/istio-gateway/vk-infra/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./ingressgateway-pa2.yaml
+  - ./ingressgateway-me1.yaml
+  - ./ingressgateway-ms1.yaml
+  - ./lb-service.yaml

infrastructure/istio-gateway/vk-infra/lb-service.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: istio-ingressgateway
+  namespace: istio-system
+  labels:
+    app: istio-ingressgateway
+    istio: ingressgateway
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: istio-ingressgateway
+    istio: ingressgateway
+  ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443

infrastructure/istio-pilot/vk-infra/istio-pilot.yaml

@@ -0,0 +1,34 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istiod
+  namespace: istio-system
+spec:
+  chart:
+    spec:
+      chart: istiod-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+  values:
+    replicaCount: 3
+    autoscaleEnabled: false
+    nodeSelector:
+      sarex.io/pool: svc
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app: istiod
+            istio: pilot
+    global:
+      hub: cr.yandex/crp3ccidau046kdj8g9q/istio
+      tag: 1.30.5-amd64
+      imagePullSecrets:
+        - istio-registry-secret
+    pilot:
+      traceSampling: 100

infrastructure/istio-pilot/vk-infra/kustomization.yaml

@@ -2,9 +2,11 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
-  - kafka-ca-configmap.yaml
 patches:
-  - path: backend.yaml
+  - path: ./istio-pilot.yaml
     target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
       kind: HelmRelease
-      name: backend
+      name: istiod
+      namespace: istio-system