refactor(d8-ugmk-prod): move istio-config to per-cluster overlay

Relocated `istio-config` from `clusters/d8-ugmk-prod/infrastructure` into `infrastructure/istio-config/d8-ugmk-prod` overlay. Updated kustomization files to reference the new overlay structure. Removed unused patches and flattened resource definitions.

clusters/d8-ugmk-prod/infrastructure/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../../infrastructure/kafka/d8-ugmk-prod
-  - ../../../infrastructure/rabbitmq/d8-ugmk-prod
-  - ../../../infrastructure/camunda/d8-ugmk-prod
-  - ../../../infrastructure/vault/d8-ugmk-prod
-  - ../../../infrastructure/postgresql/d8-ugmk-prod
-  - ../../../infrastructure/zitadel/d8-ugmk-prod

clusters/d8-ugmk-prod/kustomization.yaml

@@ -3,5 +3,14 @@ kind: Kustomization
 resources:
   - ./flux-system
   - ./helm-repositories.yaml
-  - ./infrastructure
+
+# infrastructure
+  - ../../infrastructure/kafka/d8-ugmk-prod
+  - ../../infrastructure/rabbitmq/d8-ugmk-prod
+  - ../../infrastructure/camunda/d8-ugmk-prod
+  - ../../infrastructure/vault/d8-ugmk-prod
+  - ../../infrastructure/postgresql/d8-ugmk-prod
+  - ../../infrastructure/zitadel/d8-ugmk-prod
+  - ../../infrastructure/istio-config/d8-ugmk-prod
+
   - ./bootstrap-jobs

infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml

@@ -0,0 +1,140 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: d8-ugmk-prod
+    environments:
+      d8-ugmk-prod:
+        istio:
+          gateways:
+            camunda:
+              name: camunda-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-camunda-keycloak.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda-identity.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda-tasklist.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - sarex-camunda-optimize.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+            rabbitmq:
+              name: rabbitmq-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-rabbitmq.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+            zitadel:
+              name: zitadel-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-login.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+          virtualServices:
+            camunda-keycloak:
+              namespace: default
+              hosts:
+                - sarex-camunda-keycloak.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-keycloak.camunda.svc.cluster.local
+                  port: 80
+            camunda-identity:
+              namespace: default
+              hosts:
+                - sarex-camunda-identity.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-identity.camunda.svc.cluster.local
+                  port: 80
+            camunda-operate:
+              namespace: default
+              hosts:
+                - sarex-camunda.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-operate.camunda.svc.cluster.local
+                  port: 80
+            camunda-tasklist:
+              namespace: default
+              hosts:
+                - sarex-camunda-tasklist.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-tasklist.camunda.svc.cluster.local
+                  port: 80
+            camunda-optimize:
+              namespace: default
+              hosts:
+                - sarex-camunda-optimize.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-optimize.camunda.svc.cluster.local
+                  port: 80
+            rabbitmq:
+              namespace: default
+              hosts:
+                - sarex-rabbitmq.uralmine.com
+              gateways:
+                - default/rabbitmq-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: rabbitmq.rabbitmq.svc.cluster.local
+                  port: 15672
+            zitadel:
+              namespace: default
+              hosts:
+                - sarex-login.uralmine.com
+              gateways:
+                - default/zitadel-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: zitadel-idp-contour.zitadel.svc.cluster.local
+                  port: 8080

infrastructure/istio-config/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-config.yaml