name: "core"
description: "Exordos Core element"
schema_version: 1
version: "0.2.14"
api_version: "v1"

resources:

  # IAM
  # Bootstrap IAM resources. SQL seed inserts remain for initial API authentication.
  # $core.iam.users:
  #  admin:
  #    uuid: "00000000-0000-0000-0000-000000000000"
  #    username: "admin"
  #    email: "admin@example.com"
  #    password: "admin"
  #    first_name: "Admin"
  #    last_name: "User"
  #    description: "System administrator"

  #$core.iam.clients:
  #  default:
  #    uuid: "00000000-0000-0000-0000-000000000000"
  #    name: "GenesisCoreClient"
  #    description: "Exordos Core OIDC Client"
  #   client_id: "GenesisCoreClientId"
  #    secret: "GenesisCoreSecret"
  #    signature_algorithm:
  #      kind: HS256
  #      secret_uuid: "00000000-0000-0000-0000-000000000001"
  #      previous_secret_uuid: null

  #$core.secret.passwords:
  #  iam_client_hs256_secret:
  #    uuid: "00000000-0000-0000-0000-000000000001"
  #    name: "iam-client-hs256-secret"
  #    description: "Default HS256 secret for IAM clients"
  #    project_id: "$core.iam.projects.$admin:uuid"
  #    constructor:
  #      kind: plain
  #    method: "MANUAL"
  #    value: "secret"

  $core.iam.organizations:
    admin:
      uuid: "36b790f9-1242-464b-8374-b3f9fc8842c0"
      name: "admin"
      description: "Admin Organization"
    genesis_corporation:
      uuid: "11111111-1111-1111-1111-111111111111"
      name: "Genesis Corporation"
      description: "The organization serves as the central platform for all services and elements developed by Genesis Corporation."

  $core.iam.projects:
    admin:
      uuid: "00000000-0000-0000-0000-000000000000"
      name: "admin"
      description: "Admin Project"
      organization: "$core.iam.organizations.$admin:uuid"
    iam_core:
      uuid: "c938820c-ab9c-56e4-919c-acd0e881996f"
      name: "iam-core"
      description: "Identity and Access Management Core Project"
      organization: "$core.iam.organizations.$genesis_corporation:uuid"
    compute_core:
      uuid: "46f57877-f477-5916-bcd1-718d34cf3414"
      name: "compute-core"
      description: "Compute and Baremetal Core Project"
      organization: "$core.iam.organizations.$genesis_corporation:uuid"
    dns_core:
      uuid: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
      name: "dns-core"
      description: "Dns Core Project"
      organization: "$core.iam.organizations.$genesis_corporation:uuid"

  $core.iam.roles:
    admin:
      uuid: "0f3d47b1-1f06-4e2c-8ef0-84b6b6693693"
      name: "admin"
      description: "Admin Role"
    newcomer:
      uuid: "726f6c65-0000-0000-0000-000000000001"
      name: "newcomer"
      description: "Default role for newly registered users. Provides basic system access and onboarding capabilities."
    owner:
      uuid: "726f6c65-0000-0000-0000-000000000002"
      name: "owner"
      description: "Project ownership role. Grants full administrative privileges within a specific project. Automatically assigned during project creation process."

  $core.iam.permissions:
    ua_agent_create:
      name: "agent.ua.create"
      description: "Register a Universal Agent"
    ua_agent_issue_key:
      name: "agent.ua.issue_key"
      description: "Issue or fetch a Universal Agent node encryption key"
    allow_all:
      uuid: "6883c42a-166d-4b22-a59b-9024abb10da1"
      name: "*.*.*"
      description: "Allow All"
    compute_node_create:
      uuid: "086988df-a84b-5c42-8f3a-1fd3d0dd3878"
      name: "compute.node.create"
      description: "Create own nodes"
    compute_node_delete:
      uuid: "31eff665-2e96-5202-873a-a2f3c812a281"
      name: "compute.node.delete"
      description: "Delete own nodes"
    compute_node_get_private_key:
      uuid: "b043aa0d-2535-5908-9198-42dc7faa1ba1"
      name: "compute.node.get_private_key"
      description: "Get node(s) agent private key"
    compute_node_read:
      uuid: "62dc01b3-f556-5ba3-bcd6-709c52d7418c"
      name: "compute.node.read"
      description: "List and read own nodes"
    compute_node_update:
      uuid: "44b6c954-867f-558b-9dba-b8c7baf9df38"
      name: "compute.node.update"
      description: "Update own nodes"
    compute_node_set_create:
      uuid: "28712ab0-4ce0-5b6e-b3bf-7546a1a405c6"
      name: "compute.node_set.create"
      description: "Create own node sets"
    compute_node_set_delete:
      uuid: "a111927f-efa6-501c-bb44-deab41cc5c40"
      name: "compute.node_set.delete"
      description: "Delete own node sets"
    compute_node_set_get_private_key:
      uuid: "35078e4a-7c08-5ecb-af28-ceb4c4e90f8f"
      name: "compute.node_set.get_private_key"
      description: "Get node(s) agent private key"
    compute_node_set_read:
      uuid: "93f0b1b3-6fd9-53b9-a58c-1678a3e63a42"
      name: "compute.node_set.read"
      description: "List and read own node sets"
    compute_node_set_update:
      uuid: "b140db60-8c0c-50ed-954a-c08f105e9a6c"
      name: "compute.node_set.update"
      description: "Update own node sets"
    config_config_create:
      uuid: "662d2b35-3f66-5c1d-9e67-3e37203de1f3"
      name: "config.config.create"
      description: "Create configs"
    config_config_delete:
      uuid: "36332a84-db81-51af-8b28-05ab0059eb48"
      name: "config.config.delete"
      description: "Delete configs"
    config_config_read:
      uuid: "ab09a33c-50bc-5102-b94f-d9b443cfeba0"
      name: "config.config.read"
      description: "List and read configs"
    config_config_update:
      uuid: "58a9b19d-00fe-5887-9896-28b5801025e7"
      name: "config.config.update"
      description: "Update configs"
    dns_domain_create:
      uuid: "57286e51-6554-5a13-bf43-08bebf9b37a3"
      name: "dns.domain.create"
      description: "Create own domains"
    dns_domain_delete:
      uuid: "e0896a81-15c0-5005-bfca-bcffa48867e8"
      name: "dns.domain.delete"
      description: "Delete own domains"
    dns_domain_read:
      uuid: "74d3d8e2-85fa-5a05-8caa-4a3036181f88"
      name: "dns.domain.read"
      description: "List and read own domains"
    dns_domain_update:
      uuid: "5d08d7dc-d455-59ae-aede-ae4db96b04e8"
      name: "dns.domain.update"
      description: "Update own domains"
    dns_record_create:
      uuid: "0e332cde-811c-5c91-a903-d2809acfe817"
      name: "dns.record.create"
      description: "Create own records"
    dns_record_delete:
      uuid: "3c937db2-917b-5353-82b6-66acabe83604"
      name: "dns.record.delete"
      description: "Delete own records"
    dns_record_read:
      uuid: "776e0696-32f6-50ba-b419-0bfc35c6dfe1"
      name: "dns.record.read"
      description: "List and read own records"
    dns_record_update:
      uuid: "63e98744-132e-5b67-8b83-8dc0cd7646b1"
      name: "dns.record.update"
      description: "Update own records"
    em_service_create:
      uuid: "1c0feca8-08cc-53cd-bc87-6a12c9d0ca81"
      name: "em.service.create"
      description: "Create services"
    em_service_delete:
      uuid: "3fb84d07-f56a-57be-99d6-ba890853e25d"
      name: "em.service.delete"
      description: "Delete services"
    em_service_read:
      uuid: "df63e401-39a3-5e54-833e-fb159b41e011"
      name: "em.service.read"
      description: "List and read services"
    em_service_update:
      uuid: "7fbfc393-ee82-5663-a025-961d5bff45ec"
      name: "em.service.update"
      description: "Update services"
    em_element_create:
      uuid: "f9d59d83-3c86-53f4-9ada-9753631d305f"
      name: "em.element.create"
      description: "Create elements"
    em_element_delete:
      uuid: "be1f2590-e0d4-5167-b153-41871a2a65f8"
      name: "em.element.delete"
      description: "Delete elements"
    em_element_read:
      uuid: "76f17af0-5b66-50b4-bf03-9f5997d87025"
      name: "em.element.read"
      description: "List and read elements"
    em_element_update:
      uuid: "6837803f-ab3c-5b11-93dc-e245e40a5929"
      name: "em.element.update"
      description: "Update elements"
    iam_iam_client_create:
      uuid: "29eeff9b-d316-590d-916a-766238fd669d"
      name: "iam.iam_client.create"
      description: "Allows creating IAM clients"
    iam_iam_client_delete:
      uuid: "9da293c0-1ba8-548a-a490-287d0266b507"
      name: "iam.iam_client.delete"
      description: "Allows deleting IAM clients"
    iam_iam_client_read_all:
      uuid: "4435daf0-0d20-5a00-adc8-90fd9a298147"
      name: "iam.iam_client.read_all"
      description: "Allows reading all IAM clients"
    iam_iam_client_update:
      uuid: "6d891b35-d0d9-5327-8b85-aa7a191b69c7"
      name: "iam.iam_client.update"
      description: "Allows updating IAM clients"
    iam_organization_create:
      uuid: "51330c56-c241-520f-8b83-234a0ab7ba1d"
      name: "iam.organization.create"
      description: "Allows creating new organizations"
    iam_organization_delete:
      uuid: "eea5828b-f702-5286-80b5-8afcc75cee71"
      name: "iam.organization.delete"
      description: "Allows deleting own organization"
    iam_organization_delete_all:
      uuid: "28da4c50-4487-5514-8131-dd898a7e0abd"
      name: "iam.organization.delete_all"
      description: "Allows deleting any organization"
    iam_organization_read_all:
      uuid: "c228157c-7923-59bf-8177-ab12c1e6f9c7"
      name: "iam.organization.read_all"
      description: "Allows viewing all organization details"
    iam_organization_write_all:
      uuid: "87c5691b-3f77-50eb-853b-abb0b4ff4a82"
      name: "iam.organization.write_all"
      description: "Allows modifying any organization`s data"
    iam_permission_create:
      uuid: "d9727cf5-6857-55dc-8030-d13693cc15df"
      name: "iam.permission.create"
      description: "Allows creating new permissions"
    iam_permission_delete:
      uuid: "03ca3f7f-9ef9-5169-a147-85fa0ff6a28d"
      name: "iam.permission.delete"
      description: "Allows deleting permissions"
    iam_permission_read:
      uuid: "98938bd5-b26b-5733-931b-471504c27c1c"
      name: "iam.permission.read"
      description: "Allows reading permissions"
    iam_permission_update:
      uuid: "9c540d33-dfd1-565c-82b4-3099ff277c6c"
      name: "iam.permission.update"
      description: "Allows updating existing permissions"
    iam_permission_binding_create:
      uuid: "9c60333d-ab15-504c-af52-095a752237e2"
      name: "iam.permission_binding.create"
      description: "Allows creating permission bindings"
    iam_permission_binding_delete:
      uuid: "81a119f2-3d32-5ab9-908b-f9b63a9cc8e6"
      name: "iam.permission_binding.delete"
      description: "Allows deleting permission bindings"
    iam_permission_binding_read:
      uuid: "e56faea9-9c58-5ab2-b508-6f467117c9f9"
      name: "iam.permission_binding.read"
      description: "Allows reading permission bindings"
    iam_permission_binding_update:
      uuid: "f4c9feb1-a5fc-5a92-b75b-eb47821514e2"
      name: "iam.permission_binding.update"
      description: "Allows updating permission bindings"
    iam_project_delete_all:
      uuid: "654071ab-12af-52c0-8391-ebbb582a0423"
      name: "iam.project.delete_all"
      description: "Allows deleting any project"
    iam_project_list_all:
      uuid: "eb8f0274-61eb-52ed-b054-18cd08b4ec99"
      name: "iam.project.list_all"
      description: "Allows listing projects in the system"
    iam_project_read_all:
      uuid: "626d4b57-3cc7-56d6-bf30-7c2ada04d6b0"
      name: "iam.project.read_all"
      description: "Allows reading all project details"
    iam_project_write_all:
      uuid: "c6c21054-6d17-5d67-b981-0ce0ef20e4e2"
      name: "iam.project.write_all"
      description: "Allows modifying any project`s data"
    iam_project_add_user:
      uuid: "312b878e-6015-58d5-9301-eaddd5371cb6"
      name: "iam.project.add_user"
      description: "Allows adding users to projects"
    iam_role_create:
      uuid: "5d3e126d-85be-5efb-9200-b7655db64fb4"
      name: "iam.role.create"
      description: "Allows creating new roles"
    iam_role_delete:
      uuid: "131ccaac-c6e5-5dfe-8ec2-4eeca913c938"
      name: "iam.role.delete"
      description: "Allows deleting roles"
    iam_role_read:
      uuid: "4737a4f2-dd9e-584c-9cb2-3927364481db"
      name: "iam.role.read"
      description: "Allows reading roles"
    iam_role_write:
      uuid: "b9d6d6ee-8310-58a2-a25f-ca972a7e009f"
      name: "iam.role.write"
      description: "Allows updating existing roles"
    iam_role_binding_create:
      uuid: "4c6a94fc-e18f-5d0e-8ada-daaf5d470dd2"
      name: "iam.role_binding.create"
      description: "Allows creating role bindings"
    iam_role_binding_delete:
      uuid: "d72c8adf-737b-5bbe-a026-61834dc309b6"
      name: "iam.role_binding.delete"
      description: "Allows deleting role bindings"
    iam_role_binding_read:
      uuid: "ff96b360-0f40-5aa4-9396-5de7aba31cb1"
      name: "iam.role_binding.read"
      description: "Allows reading role bindings"
    iam_role_binding_update:
      uuid: "91f74ad1-1359-5b5e-b4ff-62a580caa746"
      name: "iam.role_binding.update"
      description: "Allows updating role bindings"
    iam_service_token_create:
      uuid: "ef1dd949-29c5-514a-ad19-3502a343a9d8"
      name: "iam.service_token.create"
      description: "Create service account tokens"
    iam_user_create:
      uuid: "6e264a97-6640-59ae-8314-d55fdbf85b66"
      name: "iam.user.create"
      description: "Create IAM users"
    iam_user_delete:
      uuid: "bccfb7f4-9775-535b-8967-1d42c5d213f9"
      name: "iam.user.delete"
      description: "Allows users to delete their own account"
    iam_user_delete_all:
      uuid: "e25b27ac-85c1-50c9-b0a9-696048649c28"
      name: "iam.user.delete_all"
      description: "Allows deleting any user account"
    iam_user_list:
      uuid: "a8a7eea2-7514-53ac-a408-8b1235352310"
      name: "iam.user.list"
      description: "Allows listing users in the system"
    iam_user_read_all:
      uuid: "f64bbebd-c389-53b1-bed2-c725dc7dd1e8"
      name: "iam.user.read_all"
      description: "Allows reading all user profiles"
    iam_user_write_all:
      uuid: "880c3129-34ee-5fae-ab1f-6c8412333d49"
      name: "iam.user.write_all"
      description: "Allows modifying any user`s data"
    network_lb_create:
      uuid: "efabafc1-37ac-5845-a350-390fff7cdae4"
      name: "network.lb.create"
      description: "Create load balancers"
    network_lb_delete:
      uuid: "415c918d-d7d9-5d6e-aafc-15233c132608"
      name: "network.lb.delete"
      description: "Delete load balancers"
    network_lb_read:
      uuid: "bf77a2be-2d26-55a9-a239-c62e660f1ab4"
      name: "network.lb.read"
      description: "List and read load balancers"
    network_lb_update:
      uuid: "1f964856-a169-5403-8722-fa4f44385234"
      name: "network.lb.update"
      description: "Update load balancers"
    network_lb_backendpool_create:
      uuid: "1eec8be1-9e1d-5006-b909-907a635e5531"
      name: "network.lb_backendpool.create"
      description: "Create LB backend pools"
    network_lb_backendpool_delete:
      uuid: "572f3219-7fa0-5666-bf5e-3a59281685cb"
      name: "network.lb_backendpool.delete"
      description: "Delete LB backend pools"
    network_lb_backendpool_read:
      uuid: "b39f8ced-382d-59d7-8151-b980ac40eeea"
      name: "network.lb_backendpool.read"
      description: "List and read LB backend pools"
    network_lb_backendpool_update:
      uuid: "08c0f2ff-5aef-5652-859d-8d7125624059"
      name: "network.lb_backendpool.update"
      description: "Update LB backend pools"
    network_lb_vhost_create:
      uuid: "8a58a93d-486d-5ff4-b727-4e5726197264"
      name: "network.lb_vhost.create"
      description: "Create LB virtual hosts"
    network_lb_vhost_delete:
      uuid: "c2c96450-f23f-53f9-be44-64d50b519b93"
      name: "network.lb_vhost.delete"
      description: "Delete LB virtual hosts"
    network_lb_vhost_read:
      uuid: "bc87f63e-86de-5740-9c5c-7d19919eb992"
      name: "network.lb_vhost.read"
      description: "List and read LB virtual hosts"
    network_lb_vhost_update:
      uuid: "f9e9cf7c-c6c5-5f60-8eb7-ef4fc9153177"
      name: "network.lb_vhost.update"
      description: "Update LB virtual hosts"
    network_lb_vhost_route_create:
      uuid: "6f4186ea-6e43-504d-845a-16de6775f6d1"
      name: "network.lb_vhost_route.create"
      description: "Create LB vhost routes"
    network_lb_vhost_route_delete:
      uuid: "6b14f9a1-a64c-5ef8-b761-211d85069a20"
      name: "network.lb_vhost_route.delete"
      description: "Delete LB vhost routes"
    network_lb_vhost_route_read:
      uuid: "17860888-f181-5ed5-a2a1-38dbb6d4a598"
      name: "network.lb_vhost_route.read"
      description: "List and read LB vhost routes"
    network_lb_vhost_route_update:
      uuid: "f4e3fc03-383c-5569-a65e-5f04ea05e3c8"
      name: "network.lb_vhost_route.update"
      description: "Update LB vhost routes"
    secret_certificate_create:
      uuid: "28c3d63c-b331-42dc-86b5-5cb79bd467e0"
      name: "secret.certificate.create"
      description: "Create certificates"
    secret_certificate_delete:
      uuid: "73d511a6-5d31-4d83-af0a-3227076eabe0"
      name: "secret.certificate.delete"
      description: "Delete certificates"
    secret_certificate_read:
      uuid: "9fbcf344-550b-4069-a6b1-adcab6bfe403"
      name: "secret.certificate.read"
      description: "List and read certificates"
    secret_certificate_update:
      uuid: "296eca3a-a17f-4071-8f02-f672943da3e1"
      name: "secret.certificate.update"
      description: "Update certificates"
    secret_password_create:
      uuid: "b2f5e33a-77bf-41d7-a34e-61140f2b4f48"
      name: "secret.password.create"
      description: "Create passwords"
    secret_password_delete:
      uuid: "830d20d1-c744-44dc-b1bb-f23add9a2c0c"
      name: "secret.password.delete"
      description: "Delete passwords"
    secret_password_read:
      uuid: "988f4081-a398-4ffb-a07f-efdcf28d77ff"
      name: "secret.password.read"
      description: "List and read passwords"
    secret_password_update:
      uuid: "95e58a5a-80c1-4c16-8c4b-b7105697b182"
      name: "secret.password.update"
      description: "Update passwords"
    secret_rsa_key_create:
      uuid: "de83aee9-d972-4f22-8854-b225e2a8860c"
      name: "secret.rsa_key.create"
      description: "Create RSA keys"
    secret_rsa_key_delete:
      uuid: "a6349cdf-6f1e-4ff8-a57a-c56cd39091c6"
      name: "secret.rsa_key.delete"
      description: "Delete RSA keys"
    secret_rsa_key_read:
      uuid: "1876e7de-dc35-4dce-bf5e-292158a6b6c6"
      name: "secret.rsa_key.read"
      description: "List and read RSA keys"
    secret_rsa_key_update:
      uuid: "4d1a99a4-a4a3-4d95-8c9a-03d94d1d2e77"
      name: "secret.rsa_key.update"
      description: "Update RSA keys"
    secret_ssh_key_create:
      uuid: "e491736f-2749-42f7-ad39-bea4362cc38e"
      name: "secret.ssh_key.create"
      description: "Create SSH keys"
    secret_ssh_key_delete:
      uuid: "23102ef6-c168-4490-8cd1-4b1a6903964b"
      name: "secret.ssh_key.delete"
      description: "Delete SSH keys"
    secret_ssh_key_read:
      uuid: "42079bc1-48b3-4ffd-8131-35d1e4e5be05"
      name: "secret.ssh_key.read"
      description: "List and read SSH keys"
    secret_ssh_key_update:
      uuid: "de7298aa-45d0-442f-96a2-efc84a40c56d"
      name: "secret.ssh_key.update"
      description: "Update SSH keys"

  $core.iam.rolebinding:
    admin_role:
      uuid: "0e03425e-c46c-49c8-94f4-688a078d3178"
      user: "00000000-0000-0000-0000-000000000000"
      # user: "$core.iam.users.$admin:uuid"
      role: "$core.iam.roles.$admin:uuid"

  $core.iam.organizations_members:
    admin_admin:
      uuid: "50d31333-327e-54ff-97a8-6d24b7e44ca1"
      organization: "$core.iam.organizations.$admin:uuid"
      user: "00000000-0000-0000-0000-000000000000"
      # user: "$core.iam.users.$admin:uuid"
      role: "OWNER"
    admin_genesis_corporation:
      uuid: "a40b0ca8-3b15-59d9-842e-8f944a8a4ba0"
      organization: "$core.iam.organizations.$genesis_corporation:uuid"
      user: "00000000-0000-0000-0000-000000000000"
      # user: "$core.iam.users.$admin:uuid"
      role: "OWNER"

  $core.iam.permissionbinding:
    admin_allow_all:
      uuid: "0fa34733-a6c3-4878-83a5-30c894d41b7c"
      role: "$core.iam.roles.$admin:uuid"
      permission: "$core.iam.permissions.$allow_all:uuid"
    binding_newcomer_iam_user_delete:
      role: "$core.iam.roles.$newcomer:uuid"
      permission: "$core.iam.permissions.$iam_user_delete:uuid"
      project_id: "c938820c-ab9c-56e4-919c-acd0e881996f"
    binding_newcomer_iam_organization_create:
      role: "$core.iam.roles.$newcomer:uuid"
      permission: "$core.iam.permissions.$iam_organization_create:uuid"
      project_id: "c938820c-ab9c-56e4-919c-acd0e881996f"
    binding_newcomer_iam_organization_delete:
      role: "$core.iam.roles.$newcomer:uuid"
      permission: "$core.iam.permissions.$iam_organization_delete:uuid"
      project_id: "c938820c-ab9c-56e4-919c-acd0e881996f"
    binding_owner_compute_node_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_read:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_compute_node_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_create:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_compute_node_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_update:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_compute_node_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_delete:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_dns_domain_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$dns_domain_read:uuid"
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    binding_owner_dns_domain_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$dns_domain_create:uuid"
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    binding_owner_dns_domain_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$dns_domain_update:uuid"
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    binding_owner_dns_domain_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$dns_domain_delete:uuid"
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    binding_owner_dns_record_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$dns_record_read:uuid"
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    binding_owner_dns_record_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$dns_record_create:uuid"
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    binding_owner_dns_record_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$dns_record_update:uuid"
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    binding_owner_dns_record_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$dns_record_delete:uuid"
      project_id: "29e2e6cc-0a74-5d07-997d-bbcb65b82c93"
    binding_owner_compute_node_set_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_set_read:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_compute_node_set_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_set_create:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_compute_node_set_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_set_update:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_compute_node_set_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_set_delete:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_read:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_create:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_update:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_delete:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_vhost_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_vhost_read:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_vhost_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_vhost_create:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_vhost_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_vhost_update:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_vhost_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_vhost_delete:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_vhost_route_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_vhost_route_read:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_vhost_route_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_vhost_route_create:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_vhost_route_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_vhost_route_update:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_vhost_route_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_vhost_route_delete:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_backendpool_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_backendpool_read:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_backendpool_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_backendpool_create:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_backendpool_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_backendpool_update:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_network_lb_backendpool_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$network_lb_backendpool_delete:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_compute_node_get_private_key:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_get_private_key:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_compute_node_set_get_private_key:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$compute_node_set_get_private_key:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_config_config_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$config_config_read:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_config_config_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$config_config_create:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_config_config_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$config_config_update:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_config_config_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$config_config_delete:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_em_service_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$em_service_read:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_em_service_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$em_service_create:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_em_service_update:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$em_service_update:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_em_service_delete:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$em_service_delete:uuid"
      project_id: "$core.iam.projects.$compute_core:uuid"
    binding_owner_iam_service_token_create:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$iam_service_token_create:uuid"
    binding_owner_em_element_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$em_element_read:uuid"
    binding_owner_iam_permission_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$iam_permission_read:uuid"
    binding_owner_iam_permission_binding_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$iam_permission_binding_read:uuid"
    binding_owner_iam_role_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$iam_role_read:uuid"
    binding_owner_iam_role_binding_read:
      role: "$core.iam.roles.$owner:uuid"
      permission: "$core.iam.permissions.$iam_role_binding_read:uuid"
  $core.vs.profiles:
    develop:
      name: "develop"
      profile_type: "GLOBAL"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      description: "The develop profile"
    small:
      name: "small"
      profile_type: "GLOBAL"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      description: "The small profile"
    medium:
      name: "medium"
      profile_type: "GLOBAL"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      description: "The medium profile"
    large:
      name: "large"
      profile_type: "GLOBAL"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      description: "The large profile"
    legacy:
      name: "legacy"
      profile_type: "GLOBAL"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      description: "The legacy profile"

  $core.vs.variables:
    default_replicas:
      name: "default_replicas"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: profile
        element: null
        fallback_strategy: ignore
        profiles:
          - profile: $core.vs.profiles.$develop:uuid
            value: 1
          - profile: $core.vs.profiles.$small:uuid
            value: 1
          - profile: $core.vs.profiles.$medium:uuid
            value: 2
          - profile: $core.vs.profiles.$large:uuid
            value: 3
          - profile: $core.vs.profiles.$legacy:uuid
            value: 1
    default_cores:
      name: "default_cores"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: profile
        element: null
        fallback_strategy: ignore
        profiles:
          - profile: $core.vs.profiles.$develop:uuid
            value: 1
          - profile: $core.vs.profiles.$small:uuid
            value: 2
          - profile: $core.vs.profiles.$medium:uuid
            value: 4
          - profile: $core.vs.profiles.$large:uuid
            value: 8
          - profile: $core.vs.profiles.$legacy:uuid
            value: 2
    default_ram:
      name: "default_ram"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: profile
        element: null
        fallback_strategy: ignore
        profiles:
          - profile: $core.vs.profiles.$develop:uuid
            value: 1024
          - profile: $core.vs.profiles.$small:uuid
            value: 2048
          - profile: $core.vs.profiles.$medium:uuid
            value: 8192
          - profile: $core.vs.profiles.$large:uuid
            value: 16384
          - profile: $core.vs.profiles.$legacy:uuid
            value: 4096

    # The variable is set at the bootstrap process and keep IP address of
    # the core node. We cannot use the core set since it has a list of IPs.
    # TODO(akremenetsky): Switch to the list when the core support HA.
    core_ip_address:
      uuid: "55814431-ede5-4c4e-abd6-e61600a3069b"
      name: "core_ip_address"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: selector
        selector_strategy: latest
    core_root_disk_size:
      uuid: "695f4e94-e46b-43ae-aa66-194044740912"
      name: "core_root_disk_size"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: selector
        selector_strategy: latest
    core_data_disk_size:
      uuid: "cf92f6f5-b62f-4cc4-898c-5250a6608d51"
      name: "core_data_disk_size"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: selector
        selector_strategy: latest
    # HS256 JWKS encryption key (A256GCM, 32 bytes)
    hs256_jwks_encryption_key:
      uuid: "c371a647-e1a6-4bec-bef2-a50041bc5af2"
      name: "hs256_jwks_encryption_key"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: selector
        selector_strategy: latest
    iam_default_client_uuid:
      uuid: "d23fa962-18b8-444f-81a0-027ece98fbdb"
      name: "default_client_uuid"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: selector
        selector_strategy: latest
    iam_default_client_id:
      uuid: "239e2a55-c3ad-4adc-85a8-3fa90b669556"
      name: "default_client_id"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: selector
        selector_strategy: latest
    iam_default_client_secret:
      uuid: "784c1f6d-f9e2-47e0-a3ba-16725854ac09"
      name: "default_client_secret"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      setter:
        kind: selector
        selector_strategy: latest

  $core.compute.sets:
    core_set:
      name: core-set
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      uuid: "70c88222-b4d9-46c3-9340-aa5bfaaa4b94"
      cores: $core.vs.variables.$default_cores:value
      ram: $core.vs.variables.$default_ram:value
      replicas: $core.vs.variables.$default_replicas:value
      disk_spec:
        kind: "disks"
        disks:
          - size: $core.vs.variables.$core_root_disk_size:value
            image: "https://repo.exordos.com/exordos-elements/core/0.2.14/images/exordos-core.raw.zst"
          - size: $core.vs.variables.$core_data_disk_size:value
            label: data

  $core.dns.domains:
    local_domain:
      uuid: "afd4b306-8960-4a77-8e7d-42d46db8a7cf"
      name: "local.genesis-core.tech"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"

  $core.dns.domains.$local_domain.records:
    local_soa_record:
      uuid: "affb6c9d-7e89-5482-a2cb-f52347d60116"
      domain: "$core.dns.domains.$local_domain:uuid"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      type: "SOA"
      record:
        kind: "SOA"
        name: "@"
        ttl: 3600
        retry: 3600
        expire: 604800
        serial: 0
        refresh: 10800
        primary_dns: "a.misconfigured.dns.server.invalid"
    local_core_record:
      uuid: "6de6aa08-f229-4b81-bf4a-9207ebe2dac4"
      domain: "$core.dns.domains.$local_domain:uuid"
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      type: "A"
      record:
        kind: "A"
        name: "core"
        address: $core.vs.variables.$core_ip_address:value

# Core LB
  $core.network.lb:
    core_lb:
      name: core_lb
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      type:
        kind: core_agent
  $core.network.lb.$core_lb.backend_pools:
    core_lb_core_backend_http:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $core.network.lb.$core_lb:uuid
      endpoints:
        - kind: host
          host: 127.0.0.1
          port: 11010
          weight: 1
    core_lb_iam_cache_backend_http:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $core.network.lb.$core_lb:uuid
      endpoints:
        - kind: host
          host: 127.0.0.1
          port: 11110
          weight: 1
  $core.network.lb.$core_lb.vhosts:
    core_lb_core_http:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $core.network.lb.$core_lb:uuid
      domains:
        - "_"
      protocol: http
      port: 80
  $core.network.lb.$core_lb.vhosts.$core_lb_core_http.routes:
    core_lb_core_route:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $core.network.lb.$core_lb.vhosts.$core_lb_core_http:uuid
      condition:
        kind: prefix
        value: /api/core/
        allowed_ips:
          - 0.0.0.0/0
        actions:
          - kind: backend
            pool: $core.network.lb.$core_lb.backend_pools.$core_lb_core_backend_http:uuid
            protocol:
              kind: http
        modifiers:
          - kind: auto_header
            headers:
              - 'Host'
              - 'X-Forwarded-For'
              - 'X-Forwarded-Port'
              - 'X-Forwarded-Proto'
              - 'X-Forwarded-Prefix'
          - kind: rewrite_url
            regex: "^/api/core/(.*)"
            replacement: "/$1"
    core_lb_iam_clients:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $core.network.lb.$core_lb.vhosts.$core_lb_core_http:uuid
      condition:
        kind: prefix
        value: /api/core/v1/iam/clients/
        allowed_ips:
          - 0.0.0.0/0
        actions:
          - kind: backend
            pool: $core.network.lb.$core_lb.backend_pools.$core_lb_iam_cache_backend_http:uuid
            protocol:
              kind: http
        modifiers:
          - kind: auto_header
            headers:
              - 'Host'
              - 'X-Forwarded-For'
              - 'X-Forwarded-Port'
              - 'X-Forwarded-Proto'
              - 'X-Forwarded-Prefix'
          - kind: rewrite_url
            regex: "^/api/core/(.*)"
            replacement: "/$1"
    core_lb_iam_default_client:
      project_id: "12345678-c625-4fee-81d5-f691897b8142"
      parent: $core.network.lb.$core_lb.vhosts.$core_lb_core_http:uuid
      condition:
        kind: prefix
        value: /api/core/v1/iam/clients/default
        allowed_ips:
          - 0.0.0.0/0
        actions:
          - kind: backend
            pool: $core.network.lb.$core_lb.backend_pools.$core_lb_iam_cache_backend_http:uuid
            protocol:
              kind: http
        modifiers:
          - kind: auto_header
            headers:
              - 'Host'
              - 'X-Forwarded-For'
              - 'X-Forwarded-Port'
              - 'X-Forwarded-Proto'
              - 'X-Forwarded-Prefix'
          - kind: set_header
            name: X-Client-Id
            value: $core.vs.variables.$iam_default_client_id:value
          - kind: set_header
            name: X-Client-Secret
            value: $core.vs.variables.$iam_default_client_secret:value
          - kind: rewrite_url
            regex: "^/api/core/v1/iam/clients/default(.*)"
            replacement: f"/v1/iam/clients/{$core.vs.variables.$iam_default_client_uuid:value}$1"

exports:
  local_domain:
    link: "$core.dns.domains.$local_domain"
  core_lb:
    link: "$core.network.lb.$core_lb"
  core_lb_http_vhost:
    link: "$core.network.lb.$core_lb.vhosts.$core_lb_core_http"
  var_core_ip_address:
    link: "$core.vs.variables.$core_ip_address"
  var_default_cores:
    link: "$core.vs.variables.$default_cores"
  var_default_ram:
    link: "$core.vs.variables.$default_ram"
  var_default_replicas:
    link: "$core.vs.variables.$default_replicas"
  var_hs256_jwks_encryption_key:
    link: "$core.vs.variables.$hs256_jwks_encryption_key"
  var_iam_default_client_id:
    link: "$core.vs.variables.$iam_default_client_id"
  profile_develop:
    link: "$core.vs.profiles.$develop"
  profile_small:
    link: "$core.vs.profiles.$small"
  profile_medium:
    link: "$core.vs.profiles.$medium"
  profile_large:
    link: "$core.vs.profiles.$large"
  profile_legacy:
    link: "$core.vs.profiles.$legacy"