border: NAT gateway resource (border_agent / border_node / dedicated VM)

Introduce the Border control-plane resource: a machine-managed NAT
gateway carrying its SNAT/DNAT rules inline (jsonb[]) on one flat
resource, with a PaaS builder, user API, BorderBuilder unit tests and
network.border.* permission seeds bound to project owners.

Deployment shapes, calque of net_lb.type:
* default         -> border_agent capability on the core node's agent;
* node set        -> border_node pinned to that node's agent
                     (distributed egress, e.g. a managed realm node);
* type.kind: core -> border_node on a dedicated gateway VM the iaas
                     builder provisions (net_border_iaas -> target_node_set).

The core node's agent serves only border_agent: border_node is always
pinned by the builder, and its driver ships where the data plane lives
(realm node / border VM image), mirroring paas_lb_agent vs paas_lb_node.
The bootstrap scheduler-section rewrite keeps border_agent, and a
managed realm now registers in the ecosystem on first boot instead of
waiting for the hourly telemetry loop.

Also: single 0066 init migration (final net_border schema + permission
seeds), gcl_sdk 3.1.0, drop core's own '/' static route on the shared
LB vhost, point the CLI realm endpoint docs at Core's LB.

Author: gmelikov

docs/usage/local_deployment.md

@@ -126,10 +126,15 @@ field. Use this token as a `Bearer` token in all subsequent API requests.
 Configure the `exordos` CLI by registering a realm and a context with the admin credentials:
 
 ```bash
-exordos settings set-realm local --endpoint http://10.20.0.2:11010 --current
+exordos settings set-realm local --endpoint http://10.20.0.2:80/api/core --current
 exordos settings set-context local --name admin -u <ADMIN_USERNAME> -p <ADMIN_PASSWORD> --current
 ```
 
+The CLI authenticates against the `default` client alias (see above), which only Core's load
+balancer on port 80 knows how to rewrite. Pointing the realm at the node's own user-api port
+(`:11010`) instead skips the load balancer, so the alias can't be resolved and every command fails
+with `Can't parse value: uuid=default.`
+
 - `set-realm` registers the platform endpoint under the name `local` and marks it as the active realm.
 - `set-context` creates a named context with the admin credentials and marks it as the active context.
 

docs/usage/local_deployment.ru.md

@@ -126,10 +126,15 @@ curl --location 'http://10.20.0.2:80/api/core/v1/iam/clients/default/actions/get
 Настройте CLI `exordos`, зарегистрировав realm и контекст с учётными данными администратора:
 
 ```bash
-exordos settings set-realm local --endpoint http://10.20.0.2:11010 --current
+exordos settings set-realm local --endpoint http://10.20.0.2:80/api/core --current
 exordos settings set-context local --name admin -u <ADMIN_USERNAME> -p <ADMIN_PASSWORD> --current
 ```
 
+CLI аутентифицируется через алиас клиента `default` (см. выше), который умеет переписывать только
+балансировщик Core на порту 80. Если указать в качестве realm порт user-api самой ноды (`:11010`),
+балансировщик будет пропущен, алиас не резолвится, и любая команда падает с
+`Can't parse value: uuid=default.`
+
 - `set-realm` — регистрирует endpoint платформы под именем `local` и устанавливает его как активный realm.
 - `set-context` — создаёт именованный контекст с учётными данными администратора и устанавливает его как активный.
 

etc/exordos_universal_agent/exordos_universal_agent.conf.j2

@@ -17,6 +17,7 @@ caps_drivers =
     PasswordCapabilityDriver,
     CoreDNSCertificateCapabilityDriver,
     LBAgentCapabilityDriver,
+    BorderAgentCapabilityDriver,
     GuestMachineCapabilityDriver,
     SSHKeyCapabilityDriver,
     RenderAgentDriver
@@ -28,7 +29,8 @@ capabilities =
     password,
     certificate,
     paas_lb_agent,
-    repo_proxy_installed_element
+    repo_proxy_installed_element,
+    border_agent
 
 
 [CoreDNSCertificateCapabilityDriver]

exordos/manifests/core.yaml.j2

@@ -268,26 +268,6 @@ resources:
           - kind: rewrite_url
             regex: "^/api/core/v1/iam/clients/default(.*)"
             replacement: f"/v1/iam/clients/{$core.vs.variables.$iam_default_client_uuid:value}$1"
-    core_lb_static_route:
-      project_id: "12345678-c625-4fee-81d5-f691897b8142"
-      parent: $core.network.lb.$core_lb.vhosts.$core_lb_core_http:uuid
-      condition:
-        kind: prefix
-        value: /
-        allowed_ips:
-          - 0.0.0.0/0
-        modifiers:
-          - kind: auto_header
-            headers:
-              - 'Host'
-              - 'X-Forwarded-For'
-              - 'X-Forwarded-Port'
-              - 'X-Forwarded-Proto'
-              - 'X-Forwarded-Prefix'
-        actions:
-          - kind: local_dir
-            path: /var/www/html
-            is_spa: true
 
 exports:
   local_domain:

exordos_core/bootstrap/defaults.py

@@ -22,6 +22,7 @@
 import typing as tp
 import uuid as sys_uuid
 
+import bazooka
 from gcl_sdk.infra.dm import models as infra_models
 from restalchemy.dm import filters as dm_filters
 from restalchemy.storage import exceptions as ra_exceptions
@@ -673,3 +674,36 @@ def set_iam_default_client_secret_var(spec: dict) -> bool:
         spec["iam"]["default_client_secret"],
         c.VAR_IAM_DEFAULT_CLIENT_SECRET_UUID,
     )
+
+
+def register_realm_in_ecosystem(spec: dict[str, tp.Any]) -> bool:
+    """Self-register this realm in the ecosystem right after bootstrap.
+
+    Without this the first registration happens on the telemetry loop
+    (hourly), so a managed realm stays PROVISIONING for up to an hour
+    and races the ecosystem's provisioning timeout. Best-effort: the
+    telemetry loop remains the retrying fallback, so a failure here
+    must not fail the bootstrap.
+    """
+    endpoint = spec.get("ecosystem_endpoint", "")
+    realm_uuid = spec.get("realm_uuid", "")
+    realm_secret = spec.get("realm_secret", "")
+    if not (endpoint and realm_uuid and realm_secret):
+        LOG.info("No realm identity in spec, skipping realm registration")
+        return True
+
+    url = f"{endpoint.rstrip('/')}/api/ecosystem/v1/realms/"
+    try:
+        client = bazooka.Client(default_timeout=30)
+        client.post(
+            url,
+            json={"uuid": realm_uuid, "secret": realm_secret},
+            headers={"Content-Type": "application/json"},
+        )
+        LOG.info("Realm %s registered in ecosystem", realm_uuid)
+    except Exception:
+        LOG.exception(
+            "Failed to register realm in ecosystem (the telemetry "
+            "service will retry hourly)"
+        )
+    return True

exordos_core/cmd/bootstrap.py

@@ -415,7 +415,8 @@ def _migrate_installed_elements_configs() -> None:
     password,
     certificate,
     paas_lb_agent,
-    repo_proxy_installed_element
+    repo_proxy_installed_element,
+    border_agent
 """
     try:
         with open(UA_CONFIG_PATH, "r", encoding="utf-8") as f:
@@ -693,6 +694,10 @@ def _set_defaults_vs(spec: dict[str, tp.Any]):
         {"func": bootstrap_defaults.set_realm_secret_var, "args": [spec]},
         {"func": bootstrap_defaults.set_realm_access_token_var, "args": [spec]},
         {"func": bootstrap_defaults.set_realm_refresh_token_var, "args": [spec]},
+        # Register in the ecosystem right away: waiting for the hourly
+        # telemetry loop leaves a managed realm PROVISIONING for up to an
+        # hour, racing the ecosystem's provisioning timeout.
+        {"func": bootstrap_defaults.register_realm_in_ecosystem, "args": [spec]},
         {
             "func": bootstrap_defaults.set_hs256_jwks_encryption_key_var,
             "args": [CONF["iam"].hs256_jwks_encryption_key],

exordos_core/cmd/gservice.py

@@ -34,6 +34,15 @@
         default="https://repo.exordos.com/exordos-lbaas/0.1.0/exordos-lbaas.raw.zst",
         help="URL to get image for LB dataplane VM",
     ),
+    cfg.StrOpt(
+        "border-image",
+        default=(
+            "https://repo.exordos.com/exordos-border/0.1.0/exordos-border.raw.zst"
+        ),
+        help="URL to get the image for a `core` (VM-based) border gateway. "
+        "The image must ship the universal agent with "
+        "BorderCapabilityDriver (border_node capability).",
+    ),
 ]
 
 

exordos_core/gservice/service.py

@@ -48,6 +48,9 @@
 from exordos_core.elements.services import builders as em_builders
 from exordos_core.janitor import service as janitor_service
 from exordos_core.network import service as n_network_service
+from exordos_core.network.border.builders import iaas as net_border_iaas
+from exordos_core.network.border.builders import paas as net_border_paas
+from exordos_core.network.border.dm import models as border_models
 from exordos_core.network.lb.builders import iaas as net_lb_iaas
 from exordos_core.network.lb.builders import paas as net_lb_paas
 from exordos_core.network.lb.dm import models as lb_models
@@ -123,6 +126,11 @@ def __init__(self, iter_min_period=3, iter_pause=0.1):
             project_id=nc.NODE_SET_PROJECT,
         )
         net_lb_paas_builder = net_lb_paas.LBBuilder()
+        net_border_iaas_builder = net_border_iaas.BorderIaasBuilder(
+            instance_model=border_models.IaasBorder,
+            project_id=nc.NODE_SET_PROJECT,
+        )
+        net_border_paas_builder = net_border_paas.BorderBuilder()
 
         # Infra scheduler
         infra_scheduler = ua_scheduler_service.UniversalAgentSchedulerService(
@@ -228,6 +236,8 @@ def __init__(self, iter_min_period=3, iter_pause=0.1):
             service_builder,
             net_lb_iaas_builder,
             net_lb_paas_builder,
+            net_border_iaas_builder,
+            net_border_paas_builder,
             secret_svc,
             password_builder,
             em_builder,