diff --git a/apps/processing/wb/engine-low.yaml b/apps/processing/wb/engine-low.yaml
index f6ba7ca..f7b367c 100644
--- a/apps/processing/wb/engine-low.yaml
+++ b/apps/processing/wb/engine-low.yaml
@@ -1,441 +1,226 @@
 ---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+# Сырой Deployment (копия из дампа кластера), а не HelmRelease/universal-chart —
+# см. apps/processing/wb/engine.yaml.
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: engine-low
   namespace: workflow
-
+  labels:
+    app: engine-low
 spec:
-  interval: 10m
-
-  chart:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: engine-low
+  template:
+    metadata:
+      labels:
+        app: engine-low
     spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  # См. apps/processing/wb/engine.yaml — тот же обход абстракции чарта для
-  # serviceAccountName/automountServiceAccountToken через postRenderers.
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              kind: Deployment
-              name: engine-low
-            patch: |-
-              - op: add
-                path: /spec/template/spec/serviceAccountName
-                value: workflows-backend-sa
-              - op: add
-                path: /spec/template/spec/automountServiceAccountToken
-                value: true
-
-  values:
-    global:
-      env: _default
-
-    services:
-      engine-low:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:prod_b6e15fda
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: engine-low
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: false
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
+      serviceAccountName: workflows-backend-sa
+      automountServiceAccountToken: true
+      imagePullSecrets:
+        - name: dockerhub
+      containers:
+        - name: engine-low
+          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:prod_b6e15fda
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: RABBITMQ_HOST
+              value: "rabbitmq-service.workflow.svc.cluster.local"
+            - name: RABBITMQ_PORT
+              value: "5672/api"
+            - name: POSTGRES_ADDRESS
+              value: "sarex-vpsql-01.xc.wb.ru"
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: POSTGRES_POOL_SIZE
+              value: "20"
+            - name: ENVIRONMENT
+              value: "prod"
+            - name: WORKFLOWS_SENTRY_DSN
+              value: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
+            - name: WORKFLOWS_SENTRY_DEBUG
+              value: "0"
+            - name: API_ADDRESS
+              value: "0.0.0.0:8000"
+            - name: DJANGO_HOST
+              value: "http://backend.django.svc.cluster.local:8000"
+            - name: S3_SERVICE_ACCOUNT
+              value: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+            - name: BIM_API_V2_DB
+              value: "/etc/sarex/bim-api-v2-db-prod.json"
+            - name: PDM_API_DB
+              value: "/etc/pdm/pdm-api-db-prod.json"
+            - name: WORKSPACE_API_DB
+              value: "/etc/ws/ws-api-db-prod.json"
+            - name: ISSUE_API_DB
+              value: "/etc/issues/issue-api-db-prod.json"
+            - name: MAILGUN
+              value: "/etc/mailgun-secret/env.json"
+            - name: SMTP
+              value: "/etc/smtp-secret/smtp.json"
+            - name: INTERNAL_PDM_URL
+              value: "http://documentations-api.documentations.svc.cluster.local:8080"
+            - name: INTERNAL_FILESTREAM_URL
+              value: "http://documentations-filestream.documentations.svc.cluster.local:8080"
+            - name: EXTERNAL_PDM_URL
+              value: "http://documentations-api.documentations.svc.cluster.local:8080"
+            - name: EXTERNAL_FILESTREAM_URL
+              value: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
+            - name: RESOURCES_API_INTERNAL_HOST
+              value: "http://resources-service.resources.svc.cluster.local:8000"
+            - name: ENABLE_SQL_QUERY
+              value: "0"
+            - name: ENABLE_S3_STORAGE
+              value: "1"
+            - name: ENABLE_S3V2_STORAGE
+              value: "1"
+            - name: ENABLE_PDM_STORAGE
+              value: "1"
+            - name: ENABLE_SMTP
+              value: "1"
+            - name: ENABLE_URL_STORAGE
+              value: "1"
+            - name: ENABLE_SRX_TMP
+              value: "1"
+            - name: ENABLE_BIM_API_V2_DB
+              value: "1"
+            - name: ENABLE_WORKSPACE_API_DB
+              value: "1"
+            - name: ENABLE_ISSUE_API_DB
+              value: "1"
+            - name: ENABLE_RESOURCES_API
+              value: "1"
+            - name: ENABLE_PDM_API_DB
+              value: "1"
+            - name: ENABLE_COMPARISONS_API_DB
+              value: "1"
+            - name: ENABLE_MAIL_GUN
+              value: "1"
+            - name: ENABLE_AMQP_EXECUTOR
+              value: "0"
+            - name: ENABLE_KUBERNETES_EXECUTOR
+              value: "1"
+            - name: MAX_WORKFLOWS_LIMIT
+              value: "5"
+            - name: CPU_COUNT
+              value: "1"
+            - name: MEMORY_GI
+              value: "1"
+            - name: CPU_COUNT_LOW_RESOURCES
+              value: "1"
+            - name: MEMORY_GI_LOW_RESOURCES
+              value: "1"
+            - name: CPU_COUNT_HIGH_MEM
+              value: "1"
+            - name: MEMORY_GI_HIGH_MEM
+              value: "1"
+            - name: ENABLE_TOLERATION
+              value: "1"
+            - name: COUNT_RUNNING_WORKERS
+              value: "1"
+            - name: COUNT_CANCELING_WORKERS
+              value: "1"
+            - name: COUNT_HANDLE_JOB_WORKERS
+              value: "1"
+            - name: BIM_API_DEBUG
+              value: "0"
+            - name: BIM_API_V2_DEBUG
+              value: "0"
+            - name: PDM_API_DEBUG
+              value: "0"
+            - name: COMPARISONS_API_DEBUG
+              value: "0"
+            - name: WORKSPACE_API_DEBUG
+              value: "0"
+            - name: JOBS_NAMESPACE
+              value: "workflow"
+            - name: ISSUE_API_DEBUG
+              value: "0"
+            - name: TOLERATION_KEY
+              value: "dedicated"
+            - name: TOLERATION_VALUE
+              value: "processing-light"
+            - name: TOLERATION_KEY_HIGH_MEM
+              value: "dedicated"
+            - name: TOLERATION_VALUE_HIGH_MEM
+              value: "processing-light"
+            - name: TOLERATION_KEY_PERSISTENT
+              value: "dedicated"
+            - name: TOLERATION_VALUE_PERSISTENT
+              value: "processing-light"
+            - name: RABBITMQ_CREATE_EXCHANGE
+              value: "autodesk.inputMessage"
+            - name: RABBITMQ_CANCEL_EXCHANGE
+              value: "autodesk.cancelMessage"
+            - name: RABBITMQ_CREATE_ROUTING_KEY
+              value: "converting"
+            - name: RABBITMQ_CANCEL_TOPIC
+              value: "cancel"
+            - name: RABBITMQ_COMPLETENESS_EXCHANGE
+              value: "autodesk.outputMessage"
+            - name: RABBITMQ_COMPLETENESS_TOPIC
+              value: "output_navis"
+            - name: CONTROL_PLANE_PERIOD
+              value: "10s"
+            - name: WORKFLOW_PRIORITY
+              value: "low"
+            - name: DEFAULT_TOLERATION_KEY
+              value: "dedicated"
+            - name: DEFAULT_TOLERATION_VALUE
+              value: "processing-light"
+            - name: DEFAULT_NODE_SELECTOR_KEY
+              value: "dedicated"
+            - name: DEFAULT_NODE_SELECTOR_VALUE
+              value: "processing-light"
+            - name: RABBITMQ_USER
+              valueFrom:
+                secretKeyRef:
+                  name: rabbitmq-secret
+                  key: username
+            - name: RABBITMQ_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: rabbitmq-secret
+                  key: password
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: password
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: database
+          volumeMounts:
             - name: yc-s3
-              mountPath:
-                _default: /etc/sarex/yc-s3
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: yc-s3
-
+              mountPath: /etc/sarex/yc-s3
+              readOnly: true
             - name: django-auth
-              mountPath:
-                _default: /etc/django-auth
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: django-auth
-
+              mountPath: /etc/django-auth
+              readOnly: true
             - name: smtp-secret
-              mountPath:
-                _default: /etc/smtp-secret
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: smtp-secret
-
-        envs:
-          - name: RABBITMQ_HOST
-            value:
-              _default: "rabbitmq-service.workflow.svc.cluster.local"
-
-          - name: RABBITMQ_PORT
-            value:
-              _default: "5672/api"
-
-          - name: POSTGRES_ADDRESS
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_PORT
-            value:
-              _default: "5432"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "20"
-
-          - name: ENVIRONMENT
-            value:
-              _default: "prod"
-
-          - name: WORKFLOWS_SENTRY_DSN
-            value:
-              _default: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
-
-          - name: WORKFLOWS_SENTRY_DEBUG
-            value:
-              _default: "0"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8000"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: S3_SERVICE_ACCOUNT
-            value:
-              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
-
-          - name: BIM_API_V2_DB
-            value:
-              _default: "/etc/sarex/bim-api-v2-db-prod.json"
-
-          - name: PDM_API_DB
-            value:
-              _default: "/etc/pdm/pdm-api-db-prod.json"
-
-          - name: WORKSPACE_API_DB
-            value:
-              _default: "/etc/ws/ws-api-db-prod.json"
-
-          - name: ISSUE_API_DB
-            value:
-              _default: "/etc/issues/issue-api-db-prod.json"
-
-          - name: MAILGUN
-            value:
-              _default: "/etc/mailgun-secret/env.json"
-
-          - name: SMTP
-            value:
-              _default: "/etc/smtp-secret/smtp.json"
-
-          - name: INTERNAL_PDM_URL
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
-
-          - name: INTERNAL_FILESTREAM_URL
-            value:
-              _default: "http://documentations-filestream.documentations.svc.cluster.local:8080"
-
-          - name: EXTERNAL_PDM_URL
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
-
-          - name: EXTERNAL_FILESTREAM_URL
-            value:
-              _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
-
-          - name: RESOURCES_API_INTERNAL_HOST
-            value:
-              _default: "http://resources-service.resources.svc.cluster.local:8000"
-
-          - name: ENABLE_SQL_QUERY
-            value:
-              _default: "0"
-
-          - name: ENABLE_S3_STORAGE
-            value:
-              _default: "1"
-
-          - name: ENABLE_S3V2_STORAGE
-            value:
-              _default: "1"
-
-          - name: ENABLE_PDM_STORAGE
-            value:
-              _default: "1"
-
-          - name: ENABLE_SMTP
-            value:
-              _default: "1"
-
-          - name: ENABLE_URL_STORAGE
-            value:
-              _default: "1"
-
-          - name: ENABLE_SRX_TMP
-            value:
-              _default: "1"
-
-          - name: ENABLE_BIM_API_V2_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_WORKSPACE_API_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_ISSUE_API_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_RESOURCES_API
-            value:
-              _default: "1"
-
-          - name: ENABLE_PDM_API_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_COMPARISONS_API_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_MAIL_GUN
-            value:
-              _default: "1"
-
-          - name: ENABLE_AMQP_EXECUTOR
-            value:
-              _default: "0"
-
-          - name: ENABLE_KUBERNETES_EXECUTOR
-            value:
-              _default: "1"
-
-          - name: MAX_WORKFLOWS_LIMIT
-            value:
-              _default: "5"
-
-          - name: CPU_COUNT
-            value:
-              _default: "1"
-
-          - name: MEMORY_GI
-            value:
-              _default: "1"
-
-          - name: CPU_COUNT_LOW_RESOURCES
-            value:
-              _default: "1"
-
-          - name: MEMORY_GI_LOW_RESOURCES
-            value:
-              _default: "1"
-
-          - name: CPU_COUNT_HIGH_MEM
-            value:
-              _default: "1"
-
-          - name: MEMORY_GI_HIGH_MEM
-            value:
-              _default: "1"
-
-          - name: ENABLE_TOLERATION
-            value:
-              _default: "1"
-
-          - name: COUNT_RUNNING_WORKERS
-            value:
-              _default: "1"
-
-          - name: COUNT_CANCELING_WORKERS
-            value:
-              _default: "1"
-
-          - name: COUNT_HANDLE_JOB_WORKERS
-            value:
-              _default: "1"
-
-          - name: BIM_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: BIM_API_V2_DEBUG
-            value:
-              _default: "0"
-
-          - name: PDM_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: COMPARISONS_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: WORKSPACE_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: JOBS_NAMESPACE
-            value:
-              _default: "workflow"
-
-          - name: ISSUE_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: TOLERATION_KEY
-            value:
-              _default: "dedicated"
-
-          - name: TOLERATION_VALUE
-            value:
-              _default: "processing-light"
-
-          - name: TOLERATION_KEY_HIGH_MEM
-            value:
-              _default: "dedicated"
-
-          - name: TOLERATION_VALUE_HIGH_MEM
-            value:
-              _default: "processing-light"
-
-          - name: TOLERATION_KEY_PERSISTENT
-            value:
-              _default: "dedicated"
-
-          - name: TOLERATION_VALUE_PERSISTENT
-            value:
-              _default: "processing-light"
-
-          - name: RABBITMQ_CREATE_EXCHANGE
-            value:
-              _default: "autodesk.inputMessage"
-
-          - name: RABBITMQ_CANCEL_EXCHANGE
-            value:
-              _default: "autodesk.cancelMessage"
-
-          - name: RABBITMQ_CREATE_ROUTING_KEY
-            value:
-              _default: "converting"
-
-          - name: RABBITMQ_CANCEL_TOPIC
-            value:
-              _default: "cancel"
-
-          - name: RABBITMQ_COMPLETENESS_EXCHANGE
-            value:
-              _default: "autodesk.outputMessage"
-
-          - name: RABBITMQ_COMPLETENESS_TOPIC
-            value:
-              _default: "output_navis"
-
-          - name: CONTROL_PLANE_PERIOD
-            value:
-              _default: "10s"
-
-          - name: WORKFLOW_PRIORITY
-            value:
-              _default: "low"
-
-          - name: DEFAULT_TOLERATION_KEY
-            value:
-              _default: "dedicated"
-
-          - name: DEFAULT_TOLERATION_VALUE
-            value:
-              _default: "processing-light"
-
-          - name: DEFAULT_NODE_SELECTOR_KEY
-            value:
-              _default: "dedicated"
-
-          - name: DEFAULT_NODE_SELECTOR_VALUE
-            value:
-              _default: "processing-light"
-
-        secretEnvs:
-          - name: RABBITMQ_USER
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: RABBITMQ_PASS
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: POSTGRES_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""
+              mountPath: /etc/smtp-secret
+              readOnly: true
+      volumes:
+        - name: yc-s3
+          secret:
+            secretName: yc-s3
+        - name: django-auth
+          secret:
+            secretName: django-auth
+        - name: smtp-secret
+          secret:
+            secretName: smtp-secret
diff --git a/apps/processing/wb/engine.yaml b/apps/processing/wb/engine.yaml
index b7939e4..8f9b6d7 100644
--- a/apps/processing/wb/engine.yaml
+++ b/apps/processing/wb/engine.yaml
@@ -1,436 +1,223 @@
 ---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
+# Сырой Deployment (копия из дампа кластера), а не HelmRelease/universal-chart —
+# на universal-chart не удалось надёжно выставить serviceAccountName +
+# automountServiceAccountToken (см. историю в git), решили не гадать дальше.
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: engine
   namespace: workflow
-
+  labels:
+    app: engine
 spec:
-  interval: 10m
-
-  chart:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: engine
+  template:
+    metadata:
+      labels:
+        app: engine
     spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  # Чарт не создаёт workflows-backend-sa (он уже есть в ns workflow, заведён
-  # руками) — значения serviceAccount.enabled что true, что false чарт
-  # применяет по-своему и не даёт того же результата, что в живом дампе
-  # (serviceAccountName + automountServiceAccountToken: true на самом поде).
-  # Патчим отрендеренный Deployment напрямую, в обход абстракции чарта.
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              kind: Deployment
-              name: engine
-            patch: |-
-              - op: add
-                path: /spec/template/spec/serviceAccountName
-                value: workflows-backend-sa
-              - op: add
-                path: /spec/template/spec/automountServiceAccountToken
-                value: true
-
-  values:
-    global:
-      env: _default
-
-    services:
-      engine:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:prod_b6e15fda
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: engine
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: false
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
+      serviceAccountName: workflows-backend-sa
+      automountServiceAccountToken: true
+      imagePullSecrets:
+        - name: dockerhub
+      containers:
+        - name: engine
+          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:prod_b6e15fda
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: TOLERATION_KEY
+              value: "dedicated"
+            - name: DEFAULT_TOLERATION_KEY
+              value: "dedicated"
+            - name: DEFAULT_TOLERATION_VALUE
+              value: "processing-light"
+            - name: TOLERATION_VALUE
+              value: "processing-light"
+            - name: TOLERATION_KEY_HIGH_MEM
+              value: "dedicated"
+            - name: TOLERATION_VALUE_HIGH_MEM
+              value: "processing-light"
+            - name: TOLERATION_KEY_PERSISTENT
+              value: "dedicated"
+            - name: TOLERATION_VALUE_PERSISTENT
+              value: "processing-light"
+            - name: RABBITMQ_HOST
+              value: "rabbitmq.rabbitmq.svc.cluster.local"
+            - name: RABBITMQ_PORT
+              value: "5672/cad"
+            - name: POSTGRES_ADDRESS
+              value: "sarex-vpsql-01.xc.wb.ru"
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: WORKFLOWS_SENTRY_DSN
+              value: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
+            - name: WORKFLOWS_SENTRY_DEBUG
+              value: "0"
+            - name: POSTGRES_POOL_SIZE
+              value: "20"
+            - name: ENABLE_SMTP
+              value: "1"
+            - name: SMTP
+              value: "/etc/smtp-secret/smtp.json"
+            - name: ENVIRONMENT
+              value: "prod"
+            - name: API_ADDRESS
+              value: "0.0.0.0:8000"
+            - name: DJANGO_HOST
+              value: "http://backend.django.svc.cluster.local:8000"
+            - name: S3_SERVICE_ACCOUNT
+              value: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+            - name: BIM_API_V2_DB
+              value: "/etc/sarex/bim-api-v2-db-prod.json"
+            - name: PDM_API_DB
+              value: "/etc/pdm/pdm-api-db-prod.json"
+            - name: WORKSPACE_API_DB
+              value: "/etc/ws/ws-api-db-prod.json"
+            - name: ISSUE_API_DB
+              value: "/etc/issues/issue-api-db-prod.json"
+            - name: MAILGUN
+              value: "/etc/mailgun-secret/env.json"
+            - name: INTERNAL_PDM_URL
+              value: "http://documentations-api.documentations.svc.cluster.local:8080"
+            - name: INTERNAL_FILESTREAM_URL
+              value: "http://documentations-filestream.documentations.svc.cluster.local:8080"
+            - name: EXTERNAL_PDM_URL
+              value: "http://documentations-api.documentations.svc.cluster.local:8080"
+            - name: EXTERNAL_FILESTREAM_URL
+              value: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
+            - name: RESOURCES_API_INTERNAL_HOST
+              value: "http://resources-service.resources.svc.cluster.local:8000"
+            - name: ENABLE_SQL_QUERY
+              value: "0"
+            - name: ENABLE_S3_STORAGE
+              value: "1"
+            - name: ENABLE_S3V2_STORAGE
+              value: "1"
+            - name: ENABLE_PDM_STORAGE
+              value: "1"
+            - name: ENABLE_URL_STORAGE
+              value: "1"
+            - name: ENABLE_SRX_TMP
+              value: "1"
+            - name: ENABLE_BIM_API_V2_DB
+              value: "1"
+            - name: ENABLE_WORKSPACE_API_DB
+              value: "1"
+            - name: ENABLE_ISSUE_API_DB
+              value: "1"
+            - name: ENABLE_RESOURCES_API
+              value: "1"
+            - name: ENABLE_PDM_API_DB
+              value: "1"
+            - name: ENABLE_COMPARISONS_API_DB
+              value: "1"
+            - name: ENABLE_MAIL_GUN
+              value: "0"
+            - name: ENABLE_AMQP_EXECUTOR
+              value: "1"
+            - name: ENABLE_KUBERNETES_EXECUTOR
+              value: "1"
+            - name: MAX_WORKFLOWS_LIMIT
+              value: "5"
+            - name: CPU_COUNT
+              value: "1"
+            - name: MEMORY_GI
+              value: "1"
+            - name: CPU_COUNT_LOW_RESOURCES
+              value: "1"
+            - name: MEMORY_GI_LOW_RESOURCES
+              value: "1"
+            - name: CPU_COUNT_HIGH_MEM
+              value: "1"
+            - name: MEMORY_GI_HIGH_MEM
+              value: "1"
+            - name: ENABLE_TOLERATION
+              value: "1"
+            - name: COUNT_RUNNING_WORKERS
+              value: "1"
+            - name: COUNT_CANCELING_WORKERS
+              value: "1"
+            - name: COUNT_HANDLE_JOB_WORKERS
+              value: "1"
+            - name: BIM_API_DEBUG
+              value: "0"
+            - name: BIM_API_V2_DEBUG
+              value: "0"
+            - name: PDM_API_DEBUG
+              value: "0"
+            - name: COMPARISONS_API_DEBUG
+              value: "0"
+            - name: WORKSPACE_API_DEBUG
+              value: "0"
+            - name: JOBS_NAMESPACE
+              value: "workflow"
+            - name: ISSUE_API_DEBUG
+              value: "0"
+            - name: RABBITMQ_CREATE_EXCHANGE
+              value: "autodesk.inputMessage"
+            - name: RABBITMQ_CANCEL_EXCHANGE
+              value: "autodesk.cancelMessage"
+            - name: RABBITMQ_CREATE_ROUTING_KEY
+              value: "converting"
+            - name: RABBITMQ_CANCEL_TOPIC
+              value: "cancel"
+            - name: RABBITMQ_COMPLETENESS_EXCHANGE
+              value: "autodesk.outputMessage"
+            - name: RABBITMQ_COMPLETENESS_TOPIC
+              value: "output"
+            - name: CONTROL_PLANE_PERIOD
+              value: "10s"
+            - name: WORKFLOW_PRIORITY
+              value: "high"
+            - name: RABBITMQ_USER
+              valueFrom:
+                secretKeyRef:
+                  name: rabbitmq-secret
+                  key: username
+            - name: RABBITMQ_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: rabbitmq-secret
+                  key: password
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: password
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: database
+          volumeMounts:
             - name: yc-s3
-              mountPath:
-                _default: /etc/sarex/yc-s3
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: yc-s3
-
+              mountPath: /etc/sarex/yc-s3
+              readOnly: true
             - name: django-auth
-              mountPath:
-                _default: /etc/django-auth
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: django-auth
-
+              mountPath: /etc/django-auth
+              readOnly: true
             - name: smtp-secret
-              mountPath:
-                _default: /etc/smtp-secret
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: smtp-secret
-
-        envs:
-          - name: TOLERATION_KEY
-            value:
-              _default: "dedicated"
-
-          - name: DEFAULT_TOLERATION_KEY
-            value:
-              _default: "dedicated"
-
-          - name: DEFAULT_TOLERATION_VALUE
-            value:
-              _default: "processing-light"
-
-          - name: TOLERATION_VALUE
-            value:
-              _default: "processing-light"
-
-          - name: TOLERATION_KEY_HIGH_MEM
-            value:
-              _default: "dedicated"
-
-          - name: TOLERATION_VALUE_HIGH_MEM
-            value:
-              _default: "processing-light"
-
-          - name: TOLERATION_KEY_PERSISTENT
-            value:
-              _default: "dedicated"
-
-          - name: TOLERATION_VALUE_PERSISTENT
-            value:
-              _default: "processing-light"
-
-          - name: RABBITMQ_HOST
-            value:
-              _default: "rabbitmq.rabbitmq.svc.cluster.local"
-
-          - name: RABBITMQ_PORT
-            value:
-              _default: "5672/cad"
-
-          - name: POSTGRES_ADDRESS
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_PORT
-            value:
-              _default: "5432"
-
-          - name: WORKFLOWS_SENTRY_DSN
-            value:
-              _default: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
-
-          - name: WORKFLOWS_SENTRY_DEBUG
-            value:
-              _default: "0"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "20"
-
-          - name: ENABLE_SMTP
-            value:
-              _default: "1"
-
-          - name: SMTP
-            value:
-              _default: "/etc/smtp-secret/smtp.json"
-
-          - name: ENVIRONMENT
-            value:
-              _default: "prod"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8000"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: S3_SERVICE_ACCOUNT
-            value:
-              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
-
-          - name: BIM_API_V2_DB
-            value:
-              _default: "/etc/sarex/bim-api-v2-db-prod.json"
-
-          - name: PDM_API_DB
-            value:
-              _default: "/etc/pdm/pdm-api-db-prod.json"
-
-          - name: WORKSPACE_API_DB
-            value:
-              _default: "/etc/ws/ws-api-db-prod.json"
-
-          - name: ISSUE_API_DB
-            value:
-              _default: "/etc/issues/issue-api-db-prod.json"
-
-          - name: MAILGUN
-            value:
-              _default: "/etc/mailgun-secret/env.json"
-
-          - name: INTERNAL_PDM_URL
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
-
-          - name: INTERNAL_FILESTREAM_URL
-            value:
-              _default: "http://documentations-filestream.documentations.svc.cluster.local:8080"
-
-          - name: EXTERNAL_PDM_URL
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
-
-          - name: EXTERNAL_FILESTREAM_URL
-            value:
-              _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
-
-          - name: RESOURCES_API_INTERNAL_HOST
-            value:
-              _default: "http://resources-service.resources.svc.cluster.local:8000"
-
-          - name: ENABLE_SQL_QUERY
-            value:
-              _default: "0"
-
-          - name: ENABLE_S3_STORAGE
-            value:
-              _default: "1"
-
-          - name: ENABLE_S3V2_STORAGE
-            value:
-              _default: "1"
-
-          - name: ENABLE_PDM_STORAGE
-            value:
-              _default: "1"
-
-          - name: ENABLE_URL_STORAGE
-            value:
-              _default: "1"
-
-          - name: ENABLE_SRX_TMP
-            value:
-              _default: "1"
-
-          - name: ENABLE_BIM_API_V2_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_WORKSPACE_API_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_ISSUE_API_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_RESOURCES_API
-            value:
-              _default: "1"
-
-          - name: ENABLE_PDM_API_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_COMPARISONS_API_DB
-            value:
-              _default: "1"
-
-          - name: ENABLE_MAIL_GUN
-            value:
-              _default: "0"
-
-          - name: ENABLE_AMQP_EXECUTOR
-            value:
-              _default: "1"
-
-          - name: ENABLE_KUBERNETES_EXECUTOR
-            value:
-              _default: "1"
-
-          - name: MAX_WORKFLOWS_LIMIT
-            value:
-              _default: "5"
-
-          - name: CPU_COUNT
-            value:
-              _default: "1"
-
-          - name: MEMORY_GI
-            value:
-              _default: "1"
-
-          - name: CPU_COUNT_LOW_RESOURCES
-            value:
-              _default: "1"
-
-          - name: MEMORY_GI_LOW_RESOURCES
-            value:
-              _default: "1"
-
-          - name: CPU_COUNT_HIGH_MEM
-            value:
-              _default: "1"
-
-          - name: MEMORY_GI_HIGH_MEM
-            value:
-              _default: "1"
-
-          - name: ENABLE_TOLERATION
-            value:
-              _default: "1"
-
-          - name: COUNT_RUNNING_WORKERS
-            value:
-              _default: "1"
-
-          - name: COUNT_CANCELING_WORKERS
-            value:
-              _default: "1"
-
-          - name: COUNT_HANDLE_JOB_WORKERS
-            value:
-              _default: "1"
-
-          - name: BIM_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: BIM_API_V2_DEBUG
-            value:
-              _default: "0"
-
-          - name: PDM_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: COMPARISONS_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: WORKSPACE_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: JOBS_NAMESPACE
-            value:
-              _default: "workflow"
-
-          - name: ISSUE_API_DEBUG
-            value:
-              _default: "0"
-
-          - name: RABBITMQ_CREATE_EXCHANGE
-            value:
-              _default: "autodesk.inputMessage"
-
-          - name: RABBITMQ_CANCEL_EXCHANGE
-            value:
-              _default: "autodesk.cancelMessage"
-
-          - name: RABBITMQ_CREATE_ROUTING_KEY
-            value:
-              _default: "converting"
-
-          - name: RABBITMQ_CANCEL_TOPIC
-            value:
-              _default: "cancel"
-
-          - name: RABBITMQ_COMPLETENESS_EXCHANGE
-            value:
-              _default: "autodesk.outputMessage"
-
-          - name: RABBITMQ_COMPLETENESS_TOPIC
-            value:
-              _default: "output"
-
-          - name: CONTROL_PLANE_PERIOD
-            value:
-              _default: "10s"
-
-          - name: WORKFLOW_PRIORITY
-            value:
-              _default: "high"
-
-        secretEnvs:
-          - name: RABBITMQ_USER
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: RABBITMQ_PASS
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: POSTGRES_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""
+              mountPath: /etc/smtp-secret
+              readOnly: true
+      volumes:
+        - name: yc-s3
+          secret:
+            secretName: yc-s3
+        - name: django-auth
+          secret:
+            secretName: django-auth
+        - name: smtp-secret
+          secret:
+            secretName: smtp-secret
diff --git a/apps/processing/wb/kustomization.yaml b/apps/processing/wb/kustomization.yaml
index 45e1c94..bd51eb7 100644
--- a/apps/processing/wb/kustomization.yaml
+++ b/apps/processing/wb/kustomization.yaml
@@ -4,6 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: workflow
 resources:
+  - rbac.yaml
   - engine.yaml
   - engine-low.yaml
   - frontend.yaml
diff --git a/apps/processing/wb/rbac.yaml b/apps/processing/wb/rbac.yaml
new file mode 100644
index 0000000..9147943
--- /dev/null
+++ b/apps/processing/wb/rbac.yaml
@@ -0,0 +1,41 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: workflows-backend-jobs
+  namespace: workflow
+rules:
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: workflows-backend-jobs
+  namespace: workflow
+subjects:
+  - kind: ServiceAccount
+    name: workflows-backend-sa
+    namespace: workflow
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: workflows-backend-jobs