diff --git a/terraform/main/api_gateway.tf b/terraform/main/api_gateway.tf
index cfa765f..2aba2eb 100644
--- a/terraform/main/api_gateway.tf
+++ b/terraform/main/api_gateway.tf
@@ -17,5 +17,7 @@ resource "yandex_api_gateway" "frontend" {
     min_level    = "INFO"
   }
 
-  spec = data.template_file.frontend_api_gateway_spec.rendered
+  spec = templatefile("${path.module}/configs/api_gateway/spec.yaml", {
+    bucket_name = yandex_storage_bucket.frontend.bucket
+  })
 }
diff --git a/terraform/main/instance.tf b/terraform/main/instance.tf
index edbceba..ded7826 100644
--- a/terraform/main/instance.tf
+++ b/terraform/main/instance.tf
@@ -14,6 +14,13 @@ resource "yandex_compute_instance" "k8s_main_master" {
     ansible = "master"
   }
 
+  lifecycle {
+    prevent_destroy       = true
+    ignore_changes = [
+      hostname,
+    ]
+  }
+
   resources {
     cores         = 2
     memory        = 2
@@ -57,7 +64,13 @@ resource "yandex_compute_instance" "k8s_main_master" {
     enable-oslogin        = true
     serial-port-enable    = 1
     install-unified-agent = 0
-    user-data             = data.template_file.k8s_main_master_cloud_init.rendered
+    user-data = templatefile("${path.module}/configs/cloud_init/main_master.yaml", {
+      k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
+      k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
+      k3s_dir                        = local.k3s_data_dir
+      k3s_token                      = random_password.k3s_token.result
+      yc_cloud_id                    = var.cloud_id
+    })
   }
 
   metadata_options {
diff --git a/terraform/main/instance_group.tf b/terraform/main/instance_group.tf
index 6806e24..16e8355 100644
--- a/terraform/main/instance_group.tf
+++ b/terraform/main/instance_group.tf
@@ -68,17 +68,24 @@ resource "yandex_compute_instance_group" "k8s_master" {
       enable-oslogin        = true
       serial-port-enable    = 1
       install-unified-agent = 0
-      user-data             = data.template_file.k8s_master_cloud_init.rendered
+      user-data = templatefile("${path.module}/configs/cloud_init/master.yaml", {
+        k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
+        k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
+        k3s_dir                        = local.k3s_data_dir
+        k3s_token                      = random_password.k3s_token.result
+        k3s_master_ip                  = local.k8s_main_master_fqdn
+        yc_cloud_id                    = var.cloud_id
+      })
     }
   }
 
   scale_policy {
     fixed_scale {
-      size = 2
+      size = 3
     }
   }
   allocation_policy {
-    zones = ["ru-central1-a", "ru-central1-b"]
+    zones = ["ru-central1-a", "ru-central1-b", "ru-central1-d"]
   }
   deploy_policy {
     max_creating     = 3
@@ -185,13 +192,20 @@ resource "yandex_compute_instance_group" "k8s_worker" {
       enable-oslogin        = true
       serial-port-enable    = 1
       install-unified-agent = 0
-      user-data             = data.template_file.k8s_worker_cloud_init.rendered
+      user-data = templatefile("${path.module}/configs/cloud_init/worker.yaml", {
+        k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
+        k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
+        k3s_dir                        = local.k3s_data_dir
+        k3s_token                      = random_password.k3s_token.result
+        k3s_master_ip                  = local.k8s_main_master_fqdn
+        yc_cloud_id                    = var.cloud_id
+      })
     }
   }
 
   scale_policy {
     fixed_scale {
-      size = 1
+      size = 2
     }
   }
   allocation_policy {
diff --git a/terraform/main/loadbalancer.tf b/terraform/main/loadbalancer.tf
index 659bdd9..23a700b 100644
--- a/terraform/main/loadbalancer.tf
+++ b/terraform/main/loadbalancer.tf
@@ -11,6 +11,22 @@ resource "yandex_lb_network_load_balancer" "k8s_lb" {
       ip_version = "ipv4"
     }
   }
+  listener {
+    name = "http"
+    port = 80
+    external_address_spec {
+      address    = yandex_vpc_address.nlb.external_ipv4_address[0].address
+      ip_version = "ipv4"
+    }
+  }
+  listener {
+    name = "https"
+    port = 443
+    external_address_spec {
+      address    = yandex_vpc_address.nlb.external_ipv4_address[0].address
+      ip_version = "ipv4"
+    }
+  }
 
   attached_target_group {
     target_group_id = yandex_lb_target_group.k8s_main_master.id
diff --git a/terraform/main/outputs.tf b/terraform/main/outputs.tf
index 4436ab1..1eea07a 100644
--- a/terraform/main/outputs.tf
+++ b/terraform/main/outputs.tf
@@ -4,11 +4,11 @@ output "registry_data" {
   }
 }
 
-output "frontend_api_gateway_data" {
-  value = {
-    domain = yandex_api_gateway.frontend.domain
-  }
-}
+# output "frontend_api_gateway_data" {
+#   value = {
+#     domain = yandex_api_gateway.frontend.domain
+#   }
+# }
 
 output "registry_push_sa_key" {
   value = jsonencode({
@@ -34,18 +34,18 @@ output "registry_pull_sa_key" {
   sensitive = true
 }
 
-output "frontend_push_sa_key" {
-  value = jsonencode({
-    id                 = yandex_iam_service_account_key.frontend_push_sa_key.id
-    service_account_id = yandex_iam_service_account_key.frontend_push_sa_key.service_account_id
-    created_at         = yandex_iam_service_account_key.frontend_push_sa_key.created_at
-    key_algorithm      = yandex_iam_service_account_key.frontend_push_sa_key.key_algorithm
-    public_key         = yandex_iam_service_account_key.frontend_push_sa_key.public_key
-    private_key        = yandex_iam_service_account_key.frontend_push_sa_key.private_key
-  })
-  sensitive = true
-}
-
-output "lets_encrypt_challenges" {
-  value = yandex_cm_certificate.default.challenges
-}
+# output "frontend_push_sa_key" {
+#   value = jsonencode({
+#     id                 = yandex_iam_service_account_key.frontend_push_sa_key.id
+#     service_account_id = yandex_iam_service_account_key.frontend_push_sa_key.service_account_id
+#     created_at         = yandex_iam_service_account_key.frontend_push_sa_key.created_at
+#     key_algorithm      = yandex_iam_service_account_key.frontend_push_sa_key.key_algorithm
+#     public_key         = yandex_iam_service_account_key.frontend_push_sa_key.public_key
+#     private_key        = yandex_iam_service_account_key.frontend_push_sa_key.private_key
+#   })
+#   sensitive = true
+# }
+# 
+# output "lets_encrypt_challenges" {
+#   value = yandex_cm_certificate.default.challenges
+# }
diff --git a/terraform/main/templates.tf b/terraform/main/templates.tf
deleted file mode 100644
index f21b11f..0000000
--- a/terraform/main/templates.tf
+++ /dev/null
@@ -1,48 +0,0 @@
-data "template_file" "k8s_main_master_cloud_init" {
-  template = file("${path.module}/configs/cloud_init/main_master.yaml")
-  vars = {
-    k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
-    k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
-    k3s_dir                        = local.k3s_data_dir
-    k3s_token                      = random_password.k3s_token.result
-    yc_cloud_id                    = var.cloud_id
-  }
-}
-
-data "template_file" "k8s_master_cloud_init" {
-  template = file("${path.module}/configs/cloud_init/master.yaml")
-  vars = {
-    k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
-    k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
-    k3s_dir                        = local.k3s_data_dir
-    k3s_token                      = random_password.k3s_token.result
-    k3s_master_ip                  = local.k8s_main_master_fqdn
-    yc_cloud_id                    = var.cloud_id
-  }
-}
-
-data "template_file" "k8s_worker_cloud_init" {
-  template = file("${path.module}/configs/cloud_init/worker.yaml")
-  vars = {
-    k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
-    k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
-    k3s_dir                        = local.k3s_data_dir
-    k3s_token                      = random_password.k3s_token.result
-    k3s_master_ip                  = local.k8s_main_master_fqdn
-    yc_cloud_id                    = var.cloud_id
-  }
-}
-
-data "template_file" "frontend_api_gateway_spec" {
-  template = file("${path.module}/configs/api_gateway/spec.yaml")
-  vars = {
-    bucket_name = yandex_storage_bucket.frontend.bucket
-  }
-}
-
-data "template_file" "frontend_develop_api_gateway_spec" {
-  template = file("${path.module}/configs/api_gateway/spec.yaml")
-  vars = {
-    bucket_name = yandex_storage_bucket.frontend_develop.bucket
-  }
-}