From f09cd9d75f5520988ca4ac93ac577b501c314e98 Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Wed, 3 Jun 2026 16:03:43 +0300
Subject: [PATCH] add camunda identity optimize tls to istio

---
 .../infrastructure/patches/istio-config.yaml   | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/clusters/brusnika-stage/infrastructure/patches/istio-config.yaml b/clusters/brusnika-stage/infrastructure/patches/istio-config.yaml
index e0787a2..88d1193 100644
--- a/clusters/brusnika-stage/infrastructure/patches/istio-config.yaml
+++ b/clusters/brusnika-stage/infrastructure/patches/istio-config.yaml
@@ -13,6 +13,13 @@ spec:
         certManager:
           clusterIssuers: {}
           certificates:
+            camunda-identity-tls:
+              namespace: ingress-nginx
+              dnsNames:
+                - identity.camunda.test.sarex.brusnika.tech
+              issuerRef:
+                name: letsencrypt
+                kind: ClusterIssuer
             keycloak.camunda.test.sarex.brusnika.tech-tls:
               namespace: ingress-nginx
               dnsNames:
@@ -34,6 +41,13 @@ spec:
               issuerRef:
                 name: letsencrypt
                 kind: ClusterIssuer
+            camunda-optimize-tls:
+              namespace: ingress-nginx
+              dnsNames:
+                - optimize.camunda.test.sarex.brusnika.tech
+              issuerRef:
+                name: letsencrypt
+                kind: ClusterIssuer
             tls-public-link:
               namespace: ingress-nginx
               dnsNames:
@@ -117,6 +131,8 @@ spec:
               servers:
                 - hosts:
                     - identity.camunda.test.sarex.brusnika.tech
+                  tls:
+                    credentialName: camunda-identity-tls
             camunda-keycloak:
               name: camunda-keycloak-gw
               namespace: ingress-nginx
@@ -145,6 +161,8 @@ spec:
               servers:
                 - hosts:
                     - optimize.camunda.test.sarex.brusnika.tech
+                  tls:
+                    credentialName: camunda-optimize-tls
             camunda-tasklist:
               name: camunda-tasklist-gw
               namespace: ingress-nginx