diff --git a/clusters/yc-ecp/infrastructure/gitea-istio.yaml b/clusters/yc-ecp/infrastructure/gitea-istio.yaml
deleted file mode 100644
index 70397ab..0000000
--- a/clusters/yc-ecp/infrastructure/gitea-istio.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: gitea-cert
-  namespace: istio-system
-spec:
-  dnsNames:
-    - gitea.invest.cps.sarex.lonsdaleites.ru
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
-  secretName: gitea-tls-secret
----
-apiVersion: networking.istio.io/v1beta1
-kind: Gateway
-metadata:
-  name: gitea-gateway
-  namespace: gateway
-spec:
-  selector:
-    istio: ingressgateway
-  servers:
-    - hosts:
-        - gitea.invest.cps.sarex.lonsdaleites.ru
-      port:
-        name: http
-        number: 80
-        protocol: HTTP
-    - hosts:
-        - gitea.invest.cps.sarex.lonsdaleites.ru
-      port:
-        name: https
-        number: 443
-        protocol: HTTPS
-      tls:
-        credentialName: gitea-tls-secret
-        mode: SIMPLE
----
-apiVersion: networking.istio.io/v1beta1
-kind: VirtualService
-metadata:
-  name: gitea-virt-service
-  namespace: gitea
-spec:
-  gateways:
-    - gateway/gitea-gateway
-  hosts:
-    - gitea.invest.cps.sarex.lonsdaleites.ru
-  http:
-    - match:
-        - uri:
-            prefix: /
-      route:
-        - destination:
-            host: gitea
-            port:
-              number: 3000
diff --git a/clusters/yc-ecp/infrastructure/kustomization.yaml b/clusters/yc-ecp/infrastructure/kustomization.yaml
deleted file mode 100644
index 63b7b6b..0000000
--- a/clusters/yc-ecp/infrastructure/kustomization.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../../infrastructure/vault
-  - ./gitea-istio.yaml
-  - ./vault-istio.yaml
-patches:
-  - path: ./patches/vault.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: vault
-      namespace: vault
diff --git a/clusters/yc-ecp/infrastructure/vault-istio.yaml b/clusters/yc-ecp/infrastructure/vault-istio.yaml
deleted file mode 100644
index 37d6d6e..0000000
--- a/clusters/yc-ecp/infrastructure/vault-istio.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: vault-cert
-  namespace: istio-system
-spec:
-  dnsNames:
-    - vault.invest.cps.sarex.lonsdaleites.ru
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
-  secretName: vault-tls
----
-apiVersion: networking.istio.io/v1beta1
-kind: Gateway
-metadata:
-  name: vault-gateway
-  namespace: gateway
-spec:
-  selector:
-    istio: ingressgateway
-  servers:
-    - hosts:
-        - vault.invest.cps.sarex.lonsdaleites.ru
-      port:
-        name: http
-        number: 80
-        protocol: HTTP
-    - hosts:
-        - vault.invest.cps.sarex.lonsdaleites.ru
-      port:
-        name: https
-        number: 443
-        protocol: HTTPS
-      tls:
-        credentialName: vault-tls
-        mode: SIMPLE
----
-apiVersion: networking.istio.io/v1beta1
-kind: VirtualService
-metadata:
-  name: vault-virt-service
-  namespace: vault
-spec:
-  gateways:
-    - gateway/vault-gateway
-  hosts:
-    - vault.invest.cps.sarex.lonsdaleites.ru
-  http:
-    - match:
-        - uri:
-            prefix: /
-      route:
-        - destination:
-            host: vault-vault-contour.vault.svc.cluster.local
-            port:
-              number: 8200
diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml
index a8384a3..139913c 100644
--- a/clusters/yc-ecp/kustomization.yaml
+++ b/clusters/yc-ecp/kustomization.yaml
@@ -3,4 +3,7 @@ kind: Kustomization
 resources:
   - ./flux-system
   - ./helm-repositories.yaml
-  - ./infrastructure
+
+# infrastructure
+  - ../../infrastructure/istio-config/yc-ecp
+  - ../../infrastructure/vault/yc-ecp
diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml
new file mode 100644
index 0000000..1810ac9
--- /dev/null
+++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml
@@ -0,0 +1,77 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway
+  # в кластере нет — с зависимостями из base релиз никогда не станет Ready
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: yc-ecp
+    environments:
+      yc-ecp:
+        namespaces: []
+        certManager:
+          clusterIssuers: {}
+          certificates:
+            gitea-tls-secret:
+              namespace: istio-system
+              dnsNames:
+                - gitea.invest.cps.sarex.lonsdaleites.ru
+              issuerRef:
+                name: letsencrypt-prod
+                kind: ClusterIssuer
+            vault-tls:
+              namespace: istio-system
+              dnsNames:
+                - vault.invest.cps.sarex.lonsdaleites.ru
+              issuerRef:
+                name: letsencrypt-prod
+                kind: ClusterIssuer
+        istio:
+          gateways:
+            gitea:
+              name: gitea-gateway
+              namespace: gateway
+              servers:
+                - hosts:
+                    - gitea.invest.cps.sarex.lonsdaleites.ru
+                  tls:
+                    credentialName: gitea-tls-secret
+            vault:
+              name: vault-gateway
+              namespace: gateway
+              servers:
+                - hosts:
+                    - vault.invest.cps.sarex.lonsdaleites.ru
+                  tls:
+                    credentialName: vault-tls
+          virtualServices:
+            gitea:
+              name: gitea-virt-service
+              namespace: gitea
+              hosts:
+                - gitea.invest.cps.sarex.lonsdaleites.ru
+              gateways:
+                - gateway/gitea-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: gitea.gitea.svc.cluster.local
+                  port: 3000
+            vault:
+              name: vault-virt-service
+              namespace: vault
+              hosts:
+                - vault.invest.cps.sarex.lonsdaleites.ru
+              gateways:
+                - gateway/vault-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: vault-vault-contour.vault.svc.cluster.local
+                  port: 8200
diff --git a/infrastructure/istio-config/yc-ecp/kustomization.yaml b/infrastructure/istio-config/yc-ecp/kustomization.yaml
new file mode 100644
index 0000000..894c51a
--- /dev/null
+++ b/infrastructure/istio-config/yc-ecp/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-config.yaml
diff --git a/infrastructure/vault/yc-ecp/kustomization.yaml b/infrastructure/vault/yc-ecp/kustomization.yaml
new file mode 100644
index 0000000..dd86ecb
--- /dev/null
+++ b/infrastructure/vault/yc-ecp/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: vault.yaml
diff --git a/clusters/yc-ecp/infrastructure/patches/vault.yaml b/infrastructure/vault/yc-ecp/vault.yaml
similarity index 100%
rename from clusters/yc-ecp/infrastructure/patches/vault.yaml
rename to infrastructure/vault/yc-ecp/vault.yaml