diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml
index 00a2081..51dfb48 100644
--- a/infrastructure/istio-config/yc-ecp/istio-config.yaml
+++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml
@@ -19,27 +19,33 @@ spec:
       yc-ecp:
         namespaces: []
         certManager:
+          # чарт рендерит ClusterIssuer как `spec: {{ toYaml $ci.spec }}`,
+          # поэтому спека обязана лежать под ключом spec
           clusterIssuers:
             letsencrypt-prod:
-              acme:
-                email: "sarex@sarex.io"
-                server: "https://acme-v02.api.letsencrypt.org/directory"
-                privateKeySecretRef:
-                  name: letsencrypt-prod
-                solvers:
-                  - http01:
-                      ingress:
-                        class: istio
+              spec:
+                acme:
+                  email: "sarex@sarex.io"
+                  server: "https://acme-v02.api.letsencrypt.org/directory"
+                  privateKeySecretRef:
+                    name: letsencrypt-prod
+                  solvers:
+                    - http01:
+                        ingress:
+                          class: istio
+          # имя Certificate = ключ, имя секрета задаётся отдельно
           certificates:
-            gitea-tls-secret:
+            gitea-cert:
               namespace: istio-system
+              secretName: gitea-tls-secret
               dnsNames:
                 - gitea.invest.cps.sarex.lonsdaleites.ru
               issuerRef:
                 name: letsencrypt-prod
                 kind: ClusterIssuer
-            vault-tls:
+            vault-cert:
               namespace: istio-system
+              secretName: vault-tls
               dnsNames:
                 - vault.invest.cps.sarex.lonsdaleites.ru
               issuerRef:
@@ -53,6 +59,8 @@ spec:
               servers:
                 - hosts:
                     - gitea.invest.cps.sarex.lonsdaleites.ru
+                  httpPortName: http
+                  httpsPortName: https
                   tls:
                     credentialName: gitea-tls-secret
             vault:
@@ -61,12 +69,16 @@ spec:
               servers:
                 - hosts:
                     - vault.invest.cps.sarex.lonsdaleites.ru
+                  httpPortName: http
+                  httpsPortName: https
                   tls:
                     credentialName: vault-tls
+          # имя VirtualService = ключ, поле name чарт игнорирует.
+          # noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io
           virtualServices:
-            gitea:
-              name: gitea-virt-service
+            gitea-virt-service:
               namespace: gitea
+              noCors: true
               hosts:
                 - gitea.invest.cps.sarex.lonsdaleites.ru
               gateways:
@@ -76,9 +88,9 @@ spec:
                     prefix: /
                   service: gitea.gitea.svc.cluster.local
                   port: 3000
-            vault:
-              name: vault-virt-service
+            vault-virt-service:
               namespace: vault
+              noCors: true
               hosts:
                 - vault.invest.cps.sarex.lonsdaleites.ru
               gateways: