diff --git a/clusters/uralkal/kustomization.yaml b/clusters/uralkal/kustomization.yaml
index 2102b68..73122b5 100644
--- a/clusters/uralkal/kustomization.yaml
+++ b/clusters/uralkal/kustomization.yaml
@@ -3,3 +3,8 @@ kind: Kustomization
 resources:
   - ./flux-system
   - ./helm-repositories.yaml
+
+  - ../../infrastructure/vault/uralkal
+  - ../../infrastructure/istio-base/uralkal
+  - ../../infrastructure/istio-pilot/uralkal
+  - ../../infrastructure/istio-gateway/uralkal
diff --git a/infrastructure/istio-base/uralkal/kustomization.yaml b/infrastructure/istio-base/uralkal/kustomization.yaml
new file mode 100644
index 0000000..27bb5cb
--- /dev/null
+++ b/infrastructure/istio-base/uralkal/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
diff --git a/infrastructure/istio-gateway/uralkal/istio-gateway.yaml b/infrastructure/istio-gateway/uralkal/istio-gateway.yaml
new file mode 100644
index 0000000..6fc8da3
--- /dev/null
+++ b/infrastructure/istio-gateway/uralkal/istio-gateway.yaml
@@ -0,0 +1,37 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  values:
+    _internal_defaults_do_not_set:
+      service:
+        type: NodePort
+        ports:
+          - name: status-port
+            port: 15021
+            protocol: TCP
+            targetPort: 15021
+          - name: http2
+            port: 80
+            protocol: TCP
+            targetPort: 80
+            nodePort: 30080
+          - name: https
+            port: 443
+            protocol: TCP
+            targetPort: 443
+            nodePort: 30443
+      nodeSelector:
+        node-role.kubernetes.io/control-plane: ""
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          effect: NoSchedule
diff --git a/infrastructure/istio-gateway/uralkal/kustomization.yaml b/infrastructure/istio-gateway/uralkal/kustomization.yaml
new file mode 100644
index 0000000..ecc3c36
--- /dev/null
+++ b/infrastructure/istio-gateway/uralkal/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-gateway.yaml
diff --git a/infrastructure/istio-pilot/uralkal/istio-pilot.yaml b/infrastructure/istio-pilot/uralkal/istio-pilot.yaml
new file mode 100644
index 0000000..a7d0773
--- /dev/null
+++ b/infrastructure/istio-pilot/uralkal/istio-pilot.yaml
@@ -0,0 +1,15 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istiod
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+  values:
+    global:
+      imagePullSecrets:
+        - regcred
diff --git a/infrastructure/istio-pilot/uralkal/kustomization.yaml b/infrastructure/istio-pilot/uralkal/kustomization.yaml
new file mode 100644
index 0000000..252e659
--- /dev/null
+++ b/infrastructure/istio-pilot/uralkal/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-pilot.yaml
diff --git a/infrastructure/vault/uralkal/kustomization.yaml b/infrastructure/vault/uralkal/kustomization.yaml
new file mode 100644
index 0000000..dd86ecb
--- /dev/null
+++ b/infrastructure/vault/uralkal/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: vault.yaml
diff --git a/infrastructure/vault/uralkal/vault.yaml b/infrastructure/vault/uralkal/vault.yaml
new file mode 100644
index 0000000..7204f37
--- /dev/null
+++ b/infrastructure/vault/uralkal/vault.yaml
@@ -0,0 +1,40 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: vault
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: vault
+              name: vault-vault-contour
+            patch: |-
+              - op: replace
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: replace
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    imagePullSecrets:
+      - name: regcred
+    backup:
+      enabled: false
+    injector:
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+    server:
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+      dataStorage:
+        storageClass: local-path