control-interface/admin-frontend: drop explicit podAnnotations

universal-chart already injects proxy.istio.io/config and
traffic.sidecar.istio.io/excludeOutboundPorts by default for every
service — explicitly setting them too produced a duplicate-key YAML
error in Flux's post-render step:

  error while running post render on files: ... yaml: unmarshal errors:
    line 42: mapping key "traffic.sidecar.istio.io/excludeOutboundPorts" already defined at line 25
    line 41: mapping key "proxy.istio.io/config" already defined at line 26

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ams-sync/brusnika-stage/backend.yaml

@@ -138,6 +138,10 @@ spec:
           - name: KAFKA_SASL_MECHANISM
             value:
               _default: "SCRAM-SHA-512"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: TELEGRAM_TOKEN
             secretName:

apps/attachments/brusnika-stage/backend.yaml

@@ -110,6 +110,10 @@ spec:
           - name: YANDEX_S3_VERIFY
             value:
               _default: "false"
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "false"
+
         secretEnvs:
           - name: DATABASE_HOST
             secretName:

apps/bi/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:production_afb137d4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:contour_9cfd1a0b
           pullPolicy:
             _default: IfNotPresent
 

apps/checklists/brusnika-stage/backend.yaml

@@ -114,6 +114,18 @@ spec:
           - name: DEBUG
             value:
               _default: "false"
+          - name: DATABASE_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "checklists_db"
+
         secretEnvs:
           - name: DATABASE_HOST
             secretName:

apps/control-interface/base/admin-frontend.yaml

@@ -0,0 +1,94 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: admin-frontend
+  namespace: control-interface
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      admin-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/admin-frontend:contour_9dc27b40
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: admin-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: admin-frontend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/control-interface/base/kustomization.yaml

@@ -4,4 +4,5 @@ kind: Kustomization
 namespace: control-interface
 resources:
   - helmrelease.yaml
+  - admin-frontend.yaml
 

apps/django/brusnika-stage/celery.yaml

@@ -330,6 +330,14 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/brusnika-stage/export-project.yaml

@@ -88,6 +88,11 @@ spec:
         labels:
           monitoring: prometheus
 
+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/django/brusnika-stage/sarex-backend.yaml

@@ -313,6 +313,18 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/vad/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            # location ~^/api/pm/ {
-            #     proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
-            #     proxy_set_header Host $host;
-            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            # }
+            location ~^/api/pm/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;

apps/documentations/brusnika-prod/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_b34286a7
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -267,6 +267,15 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/api.yaml

@@ -255,6 +255,34 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/filestream.yaml

@@ -255,6 +255,19 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/pdm.yaml

@@ -308,6 +308,14 @@ spec:
           - name: WORKSPACE_URL
             value:
               _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+
         secretEnvs:
           - name: RELEASES_TOKEN
             secretName:

apps/documentations/uralkal/api.yaml

@@ -25,7 +25,7 @@ spec:
               _default: login.sarex.local.uralkali.com
           - name: USE_ZITADEL
             value:
-              _default: "1"
+              _default: "0"
           - name: FLOWS_URL
             value:
               _default: http://backend-svc.flows.svc.cluster.local:80

apps/documentations/uralkal/filestream.yaml

@@ -25,7 +25,7 @@ spec:
               _default: login.sarex.local.uralkali.com
           - name: USE_ZITADEL
             value:
-              _default: "1"
+              _default: "0"
           - name: FLOWS_URL
             value:
               _default: http://backend-svc.flows.svc.cluster.local:80

apps/eav/brusnika-stage/helmrelease.yaml

@@ -166,6 +166,10 @@ spec:
           - name: YC_S3_BUCKET_NAME
             value:
               _default: "eav"
+          - name: KAFKA_ENABLED
+            value:
+              _default: "False"
+
         secretEnvs:
           - name: KAFKA_PASSWORD
             secretName:

apps/flows/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 
@@ -225,6 +225,22 @@ spec:
           - name: DOCUMENTATION_TIMEOUT
             value:
               _default: "60"
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: PROXY_PATH_PREFIX
+            value:
+              _default: "/flows"
+
+          - name: CHECKLIST_HOST
+            value:
+              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
+
         secretEnvs:
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:

apps/flows/brusnika-stage/celery.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 
@@ -223,6 +223,34 @@ spec:
           - name: DOCUMENTATION_TIMEOUT
             value:
               _default: "60"
+          - name: FLOWS_HOST
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: RESOURCES_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: FLOWS_DB_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: FLOWS_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: DJANGO_BASE_HOST
+            value:
+              _default: "https://test.sarex.brusnika.tech"
+
         secretEnvs:
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:

apps/flows/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_dcc5b5e6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_b52d632c
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:production_786e19c3
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
           pullPolicy:
             _default: IfNotPresent
 
@@ -158,6 +158,22 @@ spec:
           - name: KAFKA_TOPIC_COMPANY_RESOURCE_PERMISSIONS
             value:
               _default: "company_resource_permissions"
+          - name: AUTH_ENABLED
+            value:
+              _default: "true"
+
+          - name: ZITADEL_ENABLED
+            value:
+              _default: "false"
+
+          - name: ZITADEL_ORG_RULES_FILE
+            value:
+              _default: "config/zitadel/org-rules-prod.json"
+
+          - name: KAFKA_TOPIC_LEGACY_AMS_SYNC
+            value:
+              _default: "ams-sync"
+
         secretEnvs:
           - name: DB_DSN
             secretName:

apps/inspections/brusnika-stage/backend.yaml

@@ -130,6 +130,94 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+          - name: DEBUG
+            value:
+              _default: "false"
+
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: "/inspections"
+
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "3"
+
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "https://test.sarex.brusnika.tech"
+
+          - name: SAREX_BACKEND_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_EMAIL_DOCKER_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/notification:email"
+
+          - name: MOBILE_APP_CURRENT_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_RECOMMENDED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_REQUIRED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MAILER_URL
+            value:
+              _default: "http://mailer-service.mailer:8000"
+
+          - name: MAILER_TIMEOUT
+            value:
+              _default: "30"
+
         secretEnvs:
           - name: DATABASE_USER
             secretName:

apps/issues/brusnika-stage/backend.yaml

@@ -176,6 +176,10 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:

apps/issues/brusnika-stage/celery.yaml

@@ -187,6 +187,18 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+          - name: USE_NOTIFICATIONS
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:

apps/rfi/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d
           pullPolicy:
             _default: IfNotPresent
 
@@ -102,7 +102,7 @@ spec:
 
           - name: NOTIFICATIONS_SERVICE_URL
             value:
-              _default: "https://lk.srx.wb.ru:30443/rfi"
+              _default: "https://test.sarex.brusnika.tech"
 
           - name: SAREX_BACKEND_URL
             value:
@@ -131,6 +131,10 @@ spec:
           - name: DB_PORT
             value:
               _default: "5432"
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: DJANGO_SECRET_KEY
             secretName:

apps/transmittal/brusnika-stage/backend.yaml

@@ -343,7 +343,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
             value:
-              _default: "hello@wb.io"
+              _default: "smtp-relay.gmail.com"
         secretEnvs:
           - name: TRANSMITTAL_SERVICE_DATABASE__USER
             secretName:

apps/transmittal/brusnika-stage/worker.yaml

@@ -334,7 +334,23 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
             value:
-              _default: "hello@wb.io"
+              _default: "smtp-relay.gmail.com"
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT
+            value:
+              _default: "30"
+
         secretEnvs:
           - name: TRANSMITTAL_SERVICE_DATABASE__USER
             secretName:

infrastructure/istio-config/brusnika-stage/istio-config.yaml

@@ -469,6 +469,212 @@ spec:
                     prefix: /
                   service: gitea.gitea.svc.cluster.local
                   port: 3000
+            workflows-static-vs:
+              namespace: workflow
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /static/workflows/
+                  rewrite: /
+                  service: frontend-service.workflow.svc.cluster.local
+                  port: 8080
+            workspaces-v2-static-vs:
+              namespace: workspaces
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /static/workspaces-v2/
+                  rewrite: /
+                  service: workspaces-v2-frontend-static-service.workspaces.svc.cluster.local
+                  port: 8080
+            checklists-vs:
+              namespace: checklist
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /checklists/admin/
+                  service: backend-service.checklist.svc.cluster.local
+                  port: 8000
+                - path:
+                    prefix: /checklists/api/
+                  rewrite: /api/
+                  service: backend-service.checklist.svc.cluster.local
+                  port: 8000
+            res-admin-vs:
+              namespace: resources
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /res-admin/
+                  service: resources-service.resources.svc.cluster.local
+                  port: 8000
+            inspections-vs:
+              namespace: inspections
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /inspections/static/
+                  rewrite: /
+                  service: frontend-service.inspections.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /inspections/api/
+                  rewrite: /api/
+                  service: inspections-service.inspections.svc.cluster.local
+                  port: 80
+            workflows-api-vs:
+              namespace: workflow
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /workflows/api/
+                  rewrite: /api/
+                  service: workflows-api-service.workflow.svc.cluster.local
+                  port: 8000
+            workspaces-api-vs:
+              namespace: workspaces
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /workspaces/api/
+                  rewrite: /api/
+                  service: workspaces-service.workspaces.svc.cluster.local
+                  port: 8000
+            global-media-vs:
+              namespace: django
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /media/
+                  rewrite: /
+                  service: s3-proxy-service.django.svc.cluster.local
+                  port: 80
+            remarks-static-vs:
+              namespace: issues
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /remarks/static/
+                  rewrite: /
+                  service: remarks-static.issues.svc.cluster.local
+                  port: 80
+            global-resources-vs:
+              namespace: resources
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /resources/
+                  rewrite: /
+                  service: resources-service.resources.svc.cluster.local
+                  port: 8000
+            comparisons-vs:
+              namespace: comparisons
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /comparisons/static/
+                  rewrite: /
+                  service: comparisons-service.comparisons.svc.cluster.local
+                  port: 8080
+                - path:
+                    prefix: /comparisons/api/
+                  rewrite: /api/
+                  service: backend-service.comparisons.svc.cluster.local
+                  port: 80
+            administration-users-vs:
+              namespace: django
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /administration/users
+                  service: frontend-service.django.svc.cluster.local
+                  port: 80
+            orchestrator-vs:
+              namespace: orchestrator
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /orchestrator/
+                  service: cde.orchestrator.svc.cluster.local
+                  port: 8080
             global-test-vs:
               namespace: global-ingress
               hosts:
@@ -982,19 +1188,19 @@ spec:
                   service: workspaces-service.workspaces.svc.cluster.local
                   port: 8000
 
-#            vs-resources-admin:
-#              namespace: ingress-nginx
-#              hosts:
-#                - test.sarex.brusnika.tech
-#              gateways:
-#                - ingress-nginx/main-gateway
-#              routes:
-#                - match:
-#                    - uri:
-#                        prefix: /resource-management
-#                  rewrite: /resource-management
-#                  service: resources-service.resources.svc.cluster.local
-#                  port: 8000
+            vs-resources-admin:
+              namespace: ingress-nginx
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              routes:
+                - match:
+                    - uri:
+                        prefix: /resource-management
+                  rewrite: /resource-management
+                  service: resources-service.resources.svc.cluster.local
+                  port: 8000
 
 #            vs-workspaces-frontend-v2:
 #              namespace: ingress-nginx

infrastructure/istio-config/vad/istio-config.yaml

@@ -399,6 +399,19 @@ spec:
                   rewrite: /
                   service: frontend-svc.control-interface.svc.cluster.local
                   port: 8080
+            admin-frontend:
+              name: admin-frontend-virt-service
+              namespace: default
+              hosts:
+                - sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /admin-frontend/static/
+                  rewrite: /
+                  service: admin-frontend-svc.control-interface.svc.cluster.local
+                  port: 8080
             s3-proxy-media:
               name: s3-proxy-media-virt-service
               namespace: default