diff --git a/clusters/vk-prod/infrastructure/kustomization.yaml b/clusters/vk-prod/infrastructure/kustomization.yaml
index d5c91fe..6a749ed 100644
--- a/clusters/vk-prod/infrastructure/kustomization.yaml
+++ b/clusters/vk-prod/infrastructure/kustomization.yaml
@@ -7,4 +7,6 @@ resources:
   - ../../../infrastructure/gitlab-runner/vk-prod
   - ../../../infrastructure/rabbitmq/vk-prod
   - ../../../infrastructure/kafka/vk-prod
+  - ../../../infrastructure/cert-manager/vk-prod
+  - ../../../infrastructure/istio-config/vk-prod
   - ../../../infrastructure/camunda/vk-prod
diff --git a/infrastructure/cert-manager/vk-prod/cert-manager.yaml b/infrastructure/cert-manager/vk-prod/cert-manager.yaml
new file mode 100644
index 0000000..9e6f59b
--- /dev/null
+++ b/infrastructure/cert-manager/vk-prod/cert-manager.yaml
@@ -0,0 +1,36 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      imagePullSecrets:
+        - istio-registry-secret
+    controller:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager
+        pullSecrets:
+          - istio-registry-secret
+      acmesolver:
+        image:
+          registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+          repository: acmesolver
+          pullSecrets:
+            - istio-registry-secret
+    webhook:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager-webhook
+        pullSecrets:
+          - istio-registry-secret
+    cainjector:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cainjector
+        pullSecrets:
+          - istio-registry-secret
diff --git a/infrastructure/cert-manager/vk-prod/kustomization.yaml b/infrastructure/cert-manager/vk-prod/kustomization.yaml
new file mode 100644
index 0000000..0d4089a
--- /dev/null
+++ b/infrastructure/cert-manager/vk-prod/kustomization.yaml
@@ -0,0 +1,34 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./cert-manager.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: cert-manager
+      namespace: cert-manager
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer-istio
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer-istio
diff --git a/infrastructure/istio-config/vk-prod/istio-config.yaml b/infrastructure/istio-config/vk-prod/istio-config.yaml
new file mode 100644
index 0000000..bf2c652
--- /dev/null
+++ b/infrastructure/istio-config/vk-prod/istio-config.yaml
@@ -0,0 +1,264 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+  - name: istio-base
+    namespace: istio-system
+  - name: istiod
+    namespace: istio-system
+  - name: cert-manager
+    namespace: cert-manager
+  values:
+    global:
+      env: vk-prod
+    environments:
+      vk-prod:
+        certManager:
+          clusterIssuers:
+            letsencrypt-issuer-istio:
+              spec:
+                acme:
+                  email: pavel@sarex.io
+                  privateKeySecretRef:
+                    name: letsencrypt-istio-account-key
+                  server: https://acme-v02.api.letsencrypt.org/directory
+                  solvers:
+                  - http01:
+                      ingress:
+                        class: istio
+                        podTemplate:
+                          spec:
+                            imagePullSecrets:
+                            - name: istio-registry-secret
+          certificates:
+            camunda-identity-tls:
+              namespace: istio-system
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              dnsNames:
+              - camunda-identity.platform.sarex.space
+              spec:
+                duration: 2160h
+                privateKey:
+                  rotationPolicy: Always
+                renewBefore: 360h
+            camunda-keycloak-tls:
+              namespace: istio-system
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              dnsNames:
+              - camunda-keycloak.platform.sarex.space
+              spec:
+                duration: 2160h
+                privateKey:
+                  rotationPolicy: Always
+                renewBefore: 360h
+            camunda-operate-tls:
+              namespace: istio-system
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              dnsNames:
+              - camunda-operate.platform.sarex.space
+              spec:
+                duration: 2160h
+                privateKey:
+                  rotationPolicy: Always
+                renewBefore: 360h
+            camunda-optimize-tls:
+              namespace: istio-system
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              dnsNames:
+              - camunda-optimize.platform.sarex.space
+              spec:
+                duration: 2160h
+                privateKey:
+                  rotationPolicy: Always
+                renewBefore: 360h
+            camunda-tasklist-tls:
+              namespace: istio-system
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              dnsNames:
+              - camunda-tasklist.platform.sarex.space
+              spec:
+                duration: 2160h
+                privateKey:
+                  rotationPolicy: Always
+                renewBefore: 360h
+        istio:
+          gateways:
+            camunda:
+              namespace: gateway
+              servers:
+              - hosts:
+                - camunda-keycloak.platform.sarex.space
+                tls:
+                  credentialName: camunda-keycloak-tls
+                httpsPortName: keycloak-https-443
+                httpPortName: keycloak-http-80
+              - hosts:
+                - camunda-operate.platform.sarex.space
+                tls:
+                  credentialName: camunda-operate-tls
+                httpsPortName: operate-https-443
+                httpPortName: operate-http-80
+              - hosts:
+                - camunda-identity.platform.sarex.space
+                tls:
+                  credentialName: camunda-identity-tls
+                httpsPortName: identity-https-443
+                httpPortName: identity-http-80
+              - hosts:
+                - camunda-tasklist.platform.sarex.space
+                tls:
+                  credentialName: camunda-tasklist-tls
+                httpsPortName: tasklist-https-443
+                httpPortName: tasklist-http-80
+              - hosts:
+                - camunda-optimize.platform.sarex.space
+                tls:
+                  credentialName: camunda-optimize-tls
+                httpsPortName: otpimize-https-443
+                httpPortName: optimize-http-80
+          virtualServices:
+            identity-virt-service:
+              namespace: gateway
+              hosts:
+              - camunda-identity.platform.sarex.space
+              gateways:
+              - gateway/camunda-gateway
+              cors:
+                allowHeaders:
+                - Authorization
+                - Content-Type
+                - Identity
+                allowMethods:
+                - POST
+                - GET
+                - PATCH
+                - DELETE
+                - HEAD
+                - PUT
+                - OPTIONS
+                allowOrigins:
+                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
+                omitMaxAge: true
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-identity.camunda-prod.svc.cluster.local
+            keycloak-virt-service:
+              namespace: gateway
+              hosts:
+              - camunda-keycloak.platform.sarex.space
+              gateways:
+              - gateway/camunda-gateway
+              cors:
+                allowHeaders:
+                - Authorization
+                - Content-Type
+                - Identity
+                allowMethods:
+                - POST
+                - GET
+                - PATCH
+                - DELETE
+                - HEAD
+                - PUT
+                - OPTIONS
+                allowOrigins:
+                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
+                omitMaxAge: true
+              routes:
+              - path:
+                  prefix: /auth/
+                service: camunda-keycloak.camunda-prod.svc.cluster.local
+            operate-virt-service:
+              namespace: gateway
+              hosts:
+              - camunda-operate.platform.sarex.space
+              gateways:
+              - gateway/camunda-gateway
+              cors:
+                allowHeaders:
+                - Authorization
+                - Content-Type
+                - Identity
+                allowMethods:
+                - POST
+                - GET
+                - PATCH
+                - DELETE
+                - HEAD
+                - PUT
+                - OPTIONS
+                allowOrigins:
+                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
+                omitMaxAge: true
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-operate.camunda-prod.svc.cluster.local
+            optimize-virt-service:
+              namespace: gateway
+              hosts:
+              - camunda-optimize.platform.sarex.space
+              gateways:
+              - gateway/camunda-gateway
+              cors:
+                allowHeaders:
+                - Authorization
+                - Content-Type
+                - Identity
+                allowMethods:
+                - POST
+                - GET
+                - PATCH
+                - DELETE
+                - HEAD
+                - PUT
+                - OPTIONS
+                allowOrigins:
+                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
+                omitMaxAge: true
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-optimize.camunda-prod.svc.cluster.local
+            tasklist-virt-service:
+              namespace: gateway
+              hosts:
+              - camunda-tasklist.platform.sarex.space
+              gateways:
+              - gateway/camunda-gateway
+              cors:
+                allowHeaders:
+                - Authorization
+                - Content-Type
+                - Identity
+                allowMethods:
+                - POST
+                - GET
+                - PATCH
+                - DELETE
+                - HEAD
+                - PUT
+                - OPTIONS
+                allowOrigins:
+                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
+                omitMaxAge: true
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-tasklist.camunda-prod.svc.cluster.local
diff --git a/infrastructure/istio-config/vk-prod/kustomization.yaml b/infrastructure/istio-config/vk-prod/kustomization.yaml
new file mode 100644
index 0000000..d4679f4
--- /dev/null
+++ b/infrastructure/istio-config/vk-prod/kustomization.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-config.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-config
+      namespace: default