From 26f10ce34b8e65ce07759bc50642e5019dac7750 Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Wed, 15 Jul 2026 11:50:31 +0300
Subject: [PATCH] ++ add istio routes for ugmk services

---
 .../infrastructure/kustomization.yaml         |   8 +
 .../infrastructure/patches/istio-config.yaml  | 140 ++++++++++++++++++
 2 files changed, 148 insertions(+)
 create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/istio-config.yaml

diff --git a/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml b/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml
index 2725078..8dfa458 100644
--- a/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml
+++ b/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   - ../../../infrastructure/vault
   - ../../../infrastructure/postgresql
   - ../../../infrastructure/zitadel
+  - ../../../infrastructure/istio-config
 patches:
   - path: ./patches/kafka.yaml
     target:
@@ -101,3 +102,10 @@ patches:
       version: v1
       kind: Namespace
       name: zitadel
+  - path: ./patches/istio-config.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-config
+      namespace: default
diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/istio-config.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/istio-config.yaml
new file mode 100644
index 0000000..415ef85
--- /dev/null
+++ b/clusters/d8-ugmk-prod/infrastructure/patches/istio-config.yaml
@@ -0,0 +1,140 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: d8-ugmk-prod
+    environments:
+      d8-ugmk-prod:
+        istio:
+          gateways:
+            camunda:
+              name: camunda-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-camunda-keycloak.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda-identity.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda-tasklist.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda-optimize.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+            rabbitmq:
+              name: rabbitmq-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-rabbitmq.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+            zitadel:
+              name: zitadel-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-login.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+          virtualServices:
+            camunda-keycloak:
+              namespace: default
+              hosts:
+                - sarex-camunda-keycloak.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-keycloak.camunda.svc.cluster.local
+                  port: 80
+            camunda-identity:
+              namespace: default
+              hosts:
+                - sarex-camunda-identity.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-identity.camunda.svc.cluster.local
+                  port: 80
+            camunda-operate:
+              namespace: default
+              hosts:
+                - sarex-camunda.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-operate.camunda.svc.cluster.local
+                  port: 80
+            camunda-tasklist:
+              namespace: default
+              hosts:
+                - sarex-camunda-tasklist.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-tasklist.camunda.svc.cluster.local
+                  port: 80
+            camunda-optimize:
+              namespace: default
+              hosts:
+                - sarex-camunda-optimize.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-optimize.camunda.svc.cluster.local
+                  port: 80
+            rabbitmq:
+              namespace: default
+              hosts:
+                - sarex-rabbitmq.uralmine.com
+              gateways:
+                - default/rabbitmq-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: rabbitmq.rabbitmq.svc.cluster.local
+                  port: 15672
+            zitadel:
+              namespace: default
+              hosts:
+                - sarex-login.uralmine.com
+              gateways:
+                - default/zitadel-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: zitadel-idp-contour.zitadel.svc.cluster.local
+                  port: 8080