diff --git a/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml b/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml
index 07f1f1e..8dfa458 100644
--- a/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml
+++ b/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml
@@ -1,9 +1,111 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ../../../infrastructure/kafka/d8-ugmk-prod
-  - ../../../infrastructure/rabbitmq/d8-ugmk-prod
-  - ../../../infrastructure/camunda/d8-ugmk-prod
-  - ../../../infrastructure/vault/d8-ugmk-prod
-  - ../../../infrastructure/postgresql/d8-ugmk-prod
-  - ../../../infrastructure/zitadel/d8-ugmk-prod
+  - ../../../infrastructure/kafka
+  - ../../../infrastructure/rabbitmq
+  - ../../../infrastructure/camunda
+  - ../../../infrastructure/vault
+  - ../../../infrastructure/postgresql
+  - ../../../infrastructure/zitadel
+  - ../../../infrastructure/istio-config
+patches:
+  - path: ./patches/kafka.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: kafka
+      namespace: kafka
+  - path: ./patches/kafka-namespace.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: kafka
+  - path: ./patches/rabbitmq.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: rabbitmq
+      namespace: rabbitmq
+  - path: ./patches/rabbitmq-namespace.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: rabbitmq
+  - path: ./patches/camunda.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: camunda
+      namespace: camunda
+  - path: ./patches/camunda-namespace.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: camunda
+  - path: ./patches/vault.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: vault
+      namespace: vault
+  - path: ./patches/vault-namespace.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: vault
+  - path: ./patches/postgresql.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: postgresql
+      namespace: postgresql
+  - patch: |-
+      - op: replace
+        path: /metadata/namespace
+        value: zitadel
+      - op: replace
+        path: /spec/values/primary/nodeSelector
+        value:
+          dedicated: null
+          node.deckhouse.io/group: generic
+      - op: replace
+        path: /spec/values/primary/tolerations
+        value:
+          - key: dedicated.deckhouse.io
+            operator: Equal
+            value: generic
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: postgresql
+      namespace: postgresql
+  - path: ./patches/postgresql-namespace-delete.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: postgresql
+  - path: ./patches/zitadel.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: zitadel
+      namespace: zitadel
+  - path: ./patches/zitadel-namespace.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: zitadel
+  - path: ./patches/istio-config.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-config
+      namespace: default
diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/istio-config.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/istio-config.yaml
new file mode 100644
index 0000000..415ef85
--- /dev/null
+++ b/clusters/d8-ugmk-prod/infrastructure/patches/istio-config.yaml
@@ -0,0 +1,140 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: d8-ugmk-prod
+    environments:
+      d8-ugmk-prod:
+        istio:
+          gateways:
+            camunda:
+              name: camunda-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-camunda-keycloak.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda-identity.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda-tasklist.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda-optimize.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+            rabbitmq:
+              name: rabbitmq-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-rabbitmq.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+            zitadel:
+              name: zitadel-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-login.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+          virtualServices:
+            camunda-keycloak:
+              namespace: default
+              hosts:
+                - sarex-camunda-keycloak.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-keycloak.camunda.svc.cluster.local
+                  port: 80
+            camunda-identity:
+              namespace: default
+              hosts:
+                - sarex-camunda-identity.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-identity.camunda.svc.cluster.local
+                  port: 80
+            camunda-operate:
+              namespace: default
+              hosts:
+                - sarex-camunda.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-operate.camunda.svc.cluster.local
+                  port: 80
+            camunda-tasklist:
+              namespace: default
+              hosts:
+                - sarex-camunda-tasklist.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-tasklist.camunda.svc.cluster.local
+                  port: 80
+            camunda-optimize:
+              namespace: default
+              hosts:
+                - sarex-camunda-optimize.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-optimize.camunda.svc.cluster.local
+                  port: 80
+            rabbitmq:
+              namespace: default
+              hosts:
+                - sarex-rabbitmq.uralmine.com
+              gateways:
+                - default/rabbitmq-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: rabbitmq.rabbitmq.svc.cluster.local
+                  port: 15672
+            zitadel:
+              namespace: default
+              hosts:
+                - sarex-login.uralmine.com
+              gateways:
+                - default/zitadel-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: zitadel-idp-contour.zitadel.svc.cluster.local
+                  port: 8080