IAM default client vars and disks vars

akremenetsky · gmelikov · commit 43dfface3b7b · 2026-05-29T17:38:06.000+03:00
- Added variables for IAM default client such as uuid, id, secret.
- Added variables to specify root and data disks for core set
- Logic to bootstrap scripts to handle the variables
- DRY_RUN mode for the libvirt driver

Signed-off-by: Anton Kremenetsky &lt;anton.kremenetsky@gmail.com&gt;
diff --git a/exordos/manifests/core.yaml.j2 b/exordos/manifests/core.yaml.j2
@@ -98,7 +98,20 @@ resources:
       setter:
         kind: selector
         selector_strategy: latest
-
+    core_root_disk_size:
+      uuid: "695f4e94-e46b-43ae-aa66-194044740912"
+      name: "core_root_disk_size"
+      project_id: "12345678-c625-4fee-81d5-f691897b8142"
+      setter:
+        kind: selector
+        selector_strategy: latest
+    core_data_disk_size:
+      uuid: "cf92f6f5-b62f-4cc4-898c-5250a6608d51"
+      name: "core_data_disk_size"
+      project_id: "12345678-c625-4fee-81d5-f691897b8142"
+      setter:
+        kind: selector
+        selector_strategy: latest
     # HS256 JWKS encryption key (A256GCM, 32 bytes)
     hs256_jwks_encryption_key:
       uuid: "c371a647-e1a6-4bec-bef2-a50041bc5af2"
@@ -107,6 +120,27 @@ resources:
       setter:
         kind: selector
         selector_strategy: latest
+    iam_default_client_uuid:
+      uuid: "d23fa962-18b8-444f-81a0-027ece98fbdb"
+      name: "default_client_uuid"
+      project_id: "12345678-c625-4fee-81d5-f691897b8142"
+      setter:
+        kind: selector
+        selector_strategy: latest
+    iam_default_client_id:
+      uuid: "239e2a55-c3ad-4adc-85a8-3fa90b669556"
+      name: "default_client_id"
+      project_id: "12345678-c625-4fee-81d5-f691897b8142"
+      setter:
+        kind: selector
+        selector_strategy: latest
+    iam_default_client_secret:
+      uuid: "784c1f6d-f9e2-47e0-a3ba-16725854ac09"
+      name: "default_client_secret"
+      project_id: "12345678-c625-4fee-81d5-f691897b8142"
+      setter:
+        kind: selector
+        selector_strategy: latest
 
   $core.compute.sets:
     core_set:
@@ -119,9 +153,9 @@ resources:
       disk_spec:
         kind: "disks"
         disks:
-          - size: 10
+          - size: $core.vs.variables.$core_root_disk_size:value
             image: "{{ repository | default('https://repo.exordos.com/exordos-elements') }}/core/{{ version }}/images/exordos-core.raw.zst"
-          - size: 10
+          - size: $core.vs.variables.$core_data_disk_size:value
             label: data
 
   $core.dns.domains:
@@ -203,6 +237,36 @@ resources:
           - kind: rewrite_url
             regex: "^/api/core/(.*)"
             replacement: "/$1"
+    core_lb_iam_default_client:
+      project_id: "12345678-c625-4fee-81d5-f691897b8142"
+      parent: $core.network.lb.$core_lb.vhosts.$core_lb_core_http:uuid
+      condition:
+        kind: prefix
+        value: /api/core/v1/iam/clients/default
+        allowed_ips:
+          - 0.0.0.0/0
+        actions:
+          - kind: backend
+            pool: $core.network.lb.$core_lb.backend_pools.$core_lb_core_backend_http:uuid
+            protocol:
+              kind: http
+        modifiers:
+          - kind: auto_header
+            headers:
+              - 'Host'
+              - 'X-Forwarded-For'
+              - 'X-Forwarded-Port'
+              - 'X-Forwarded-Proto'
+              - 'X-Forwarded-Prefix'
+          - kind: set_header
+            name: X-Client-Id
+            value: $core.vs.variables.$iam_default_client_id:value
+          - kind: set_header
+            name: X-Client-Secret
+            value: $core.vs.variables.$iam_default_client_secret:value
+          - kind: rewrite_url
+            regex: "^/api/core/v1/iam/clients/default(.*)"
+            replacement: f"/v1/iam/clients/{$core.vs.variables.$iam_default_client_uuid:value}$1"
     core_lb_static_route:
       project_id: "12345678-c625-4fee-81d5-f691897b8142"
       parent: $core.network.lb.$core_lb.vhosts.$core_lb_core_http:uuid
diff --git a/exordos_core/bootstrap/defaults.py b/exordos_core/bootstrap/defaults.py
@@ -38,6 +38,42 @@
 USER = "ubuntu"
 
 
+def set_var(
+    name: str,
+    value: tp.Any,
+    var_uuid: sys_uuid.UUID,
+    val_uuid: sys_uuid.UUID | None = None,
+) -> bool:
+    if val_uuid is None:
+        namespace = sys_uuid.UUID("5c8140af-4eca-4871-951e-4c939f94b39e")
+        val_uuid = sys_uuid.uuid5(namespace, name)
+
+    existing_value = vs_models.Value.objects.get_one_or_none(
+        filters={"uuid": dm_filters.EQ(val_uuid)}
+    )
+    if existing_value:
+        LOG.info("The value for the '%s' variable already exists", name)
+        return True
+
+    LOG.info("Set %s variable", name)
+    var = vs_models.Variable.objects.get_one_or_none(
+        filters={"uuid": dm_filters.EQ(var_uuid)}
+    )
+
+    # The variable hasn't been created, skip
+    if not var:
+        return False
+
+    val = vs_models.Value(
+        uuid=val_uuid,
+        variable=var,
+        value=value,
+        project_id=c.EM_HIDDEN_PROJECT_ID,
+    )
+    val.insert()
+    return True
+
+
 def add_core_set(
     spec: dict[str, tp.Any], set_active: bool = False
 ) -> "node_set_models.NodeSet":
@@ -208,7 +244,9 @@ def set_core_ip_var(value: tp.Any) -> bool:
     return True
 
 
-def init_secrets(spec: dict[str, tp.Any], global_salt, client_secret) -> None:
+def init_secrets(
+    spec: dict[str, tp.Any], global_salt: str, client_id: str, client_secret: str
+) -> None:
     """Idempotent secrets initialization."""
     # Check if the secrets are already initialized
     default_client = iam_models.IamClient.objects.get_one_or_none(
@@ -237,6 +275,7 @@ def init_secrets(spec: dict[str, tp.Any], global_salt, client_secret) -> None:
     )
     default_client.salt = admin_salt
     default_client.secret_hash = client_secret_hash
+    default_client.client_id = client_id
     default_client.save()
 
     # Regenerate secrets for the default IAM user
@@ -594,3 +633,43 @@ def set_hs256_jwks_encryption_key_var(hs256_jwks_encryption_key: str) -> bool:
     )
     hs256_val.insert()
     return True
+
+
+def set_core_root_disk_size_var(spec: dict) -> bool:
+    return set_var(
+        "core_root_disk_size",
+        spec["stand"]["bootstraps"][0]["disks"][0]["size"],
+        c.VAR_ROOT_DISK_UUID,
+    )
+
+
+def set_core_data_disk_size_var(spec: dict) -> bool:
+    return set_var(
+        "core_data_disk_size",
+        spec["stand"]["bootstraps"][0]["disks"][1]["size"],
+        c.VAR_DATA_DISK_UUID,
+    )
+
+
+def set_iam_default_client_uuid_var(spec: dict) -> bool:
+    return set_var(
+        "iam_default_client_uuid",
+        spec["iam"]["default_client_uuid"],
+        c.VAR_IAM_DEFAULT_CLIENT_UUID,
+    )
+
+
+def set_iam_default_client_id_var(spec: dict) -> bool:
+    return set_var(
+        "iam_default_client_id",
+        spec["iam"]["default_client_id"],
+        c.VAR_IAM_DEFAULT_CLIENT_ID_UUID,
+    )
+
+
+def set_iam_default_client_secret_var(spec: dict) -> bool:
+    return set_var(
+        "iam_default_client_secret",
+        spec["iam"]["default_client_secret"],
+        c.VAR_IAM_DEFAULT_CLIENT_SECRET_UUID,
+    )
diff --git a/exordos_core/cmd/bootstrap.py b/exordos_core/cmd/bootstrap.py
@@ -26,6 +26,7 @@
 import typing as tp
 import uuid as sys_uuid
 
+from gcl_sdk.clients.http import base as http_base
 from oslo_config import cfg
 from restalchemy.common import config_opts as ra_config_opts
 from restalchemy.dm import filters as dm_filters
@@ -45,6 +46,7 @@
 GCTL_CFG_DIR = f"/home/{USER}/.exordos"
 SPEC_PATH = "/mnt/cdrom/spec.json"
 MANIFEST_PATH = "/mnt/cdrom/core.yaml"
+MANIFEST_COLLECTION = "/v1/em/manifests/"
 ECOSYSTEM_REALM_MANIFEST_PATH = "/mnt/cdrom/ecosystem_realm.yaml"
 MAIN_SUBNET_UUID = sys_uuid.UUID("c910a7e1-61ae-4d56-bdd6-a59faa3cbda3")
 
@@ -67,7 +69,7 @@
     ),
     cfg.StrOpt(
         "core_endpoint",
-        default="http://localhost:11010",
+        default="http://localhost/api/core",
         help="Core endpoint",
     ),
     cfg.StrOpt(
@@ -83,11 +85,6 @@
         default=None,
         help="Global salt for IAM",
     ),
-    cfg.StrOpt(
-        "client_secret",
-        default="GenesisCoreSecret",
-        help="Client secret for IAM",
-    ),
     cfg.StrOpt(
         "hs256_jwks_encryption_key",
         default=c.DEFAULT_HS256_JWKS_ENCRYPTION_KEY,
@@ -227,7 +224,7 @@ def _apply_startup_db(spec: dict[str, tp.Any]) -> None:
         LOG.info("Machine pool %s already exists, skipping", pool.uuid)
 
 
-def _ensure_gctl_config(spec: dict[str, tp.Any]):
+def _ensure_exordos_config(spec: dict[str, tp.Any]):
     """Ensure gctl configuration file exists."""
     if "admin_password" not in spec:
         raise RuntimeError("No admin password found in spec")
@@ -269,6 +266,7 @@ def _ensure_gctl_config(spec: dict[str, tp.Any]):
 def _install_element_manifest(
     element_name: str,
     manifest_path: str,
+    spec: dict[str, tp.Any],
 ):
     """Idempotent element manifest installation."""
     element = em_models.Element.objects.get_one_or_none(
@@ -283,10 +281,34 @@ def _install_element_manifest(
         LOG.info("No manifest file found at %s", manifest_path)
         return
 
-    os.system(
-        f"exordos --config {GCTL_CFG_DIR}/exordosctl.yaml ee install {manifest_path}"
+    with open(manifest_path) as f:
+        manifest_data = yaml.safe_load(f)
+
+    auth = http_base.CoreIamAuthenticator(
+        base_url="http://localhost:11010",
+        username=CONF.core_user,
+        password=spec["admin_password"],
+        client_id=spec["iam"]["default_client_id"],
+        client_secret=spec["iam"]["default_client_secret"],
+        client_uuid=sys_uuid.UUID(spec["iam"]["default_client_uuid"]),
+    )
+
+    client = http_base.CollectionBaseClient(
+        base_url="http://localhost:11010", auth=auth
     )
 
+    manifest_data = client.create(MANIFEST_COLLECTION, manifest_data)
+    try:
+        client.do_action(
+            MANIFEST_COLLECTION, "install", manifest_data["uuid"], invoke=True
+        )
+    except Exception:
+        LOG.exception(
+            "Failed to install manifest %s, deleting...", manifest_data["uuid"]
+        )
+        client.delete(MANIFEST_COLLECTION, manifest_data["uuid"])
+        raise
+
 
 def _set_defaults_vs(spec: dict[str, tp.Any]):
     """Set default values, profiles, etc."""
@@ -297,6 +319,8 @@ def _set_defaults_vs(spec: dict[str, tp.Any]):
             "func": bootstrap_defaults.set_core_ip_var,
             "args": [spec["stand"]["bootstraps"][0]["ports"][0]["ip"]],
         },
+        {"func": bootstrap_defaults.set_core_root_disk_size_var, "args": [spec]},
+        {"func": bootstrap_defaults.set_core_data_disk_size_var, "args": [spec]},
         {"func": bootstrap_defaults.set_ecosystem_endpoint_var, "args": [spec]},
         {"func": bootstrap_defaults.set_disable_telemetry_var, "args": [spec]},
         {"func": bootstrap_defaults.set_realm_uuid_var, "args": [spec]},
@@ -307,6 +331,9 @@ def _set_defaults_vs(spec: dict[str, tp.Any]):
             "func": bootstrap_defaults.set_hs256_jwks_encryption_key_var,
             "args": [CONF["iam"].hs256_jwks_encryption_key],
         },
+        {"func": bootstrap_defaults.set_iam_default_client_uuid_var, "args": [spec]},
+        {"func": bootstrap_defaults.set_iam_default_client_id_var, "args": [spec]},
+        {"func": bootstrap_defaults.set_iam_default_client_secret_var, "args": [spec]},
     ]
 
     # Perform all tasks to set default values until timeout
@@ -354,13 +381,16 @@ def main() -> None:
             LOG.info("GC Bootstrap script")
             bootstrap_defaults.apply_startup_db(spec)
             bootstrap_defaults.init_secrets(
-                spec, CONF["iam"].global_salt, CONF["iam"].client_secret
+                spec,
+                CONF["iam"].global_salt,
+                spec["iam"]["default_client_id"],
+                spec["iam"]["default_client_secret"],
             )
             bootstrap_defaults.add_core_set(spec)
-            _ensure_gctl_config(spec)
-            _install_element_manifest("core", CONF.manifest_path)
+            _ensure_exordos_config(spec)
+            _install_element_manifest("core", CONF.manifest_path, spec)
             _install_element_manifest(
-                "ecosystem_realm", CONF.ecosystem_realm_manifest_path
+                "ecosystem_realm", CONF.ecosystem_realm_manifest_path, spec
             )
             _set_defaults_vs(spec)
             return
diff --git a/exordos_core/common/constants.py b/exordos_core/common/constants.py
@@ -24,7 +24,14 @@
 CORE_SET_UUID = sys_uuid.UUID("70c88222-b4d9-46c3-9340-aa5bfaaa4b94")
 MAIN_SUBNET_UUID = sys_uuid.UUID("c910a7e1-61ae-4d56-bdd6-a59faa3cbda3")
 VAR_CORE_IP_ADDRESS_UUID = sys_uuid.UUID("55814431-ede5-4c4e-abd6-e61600a3069b")
+VAR_ROOT_DISK_UUID = sys_uuid.UUID("695f4e94-e46b-43ae-aa66-194044740912")
+VAR_DATA_DISK_UUID = sys_uuid.UUID("cf92f6f5-b62f-4cc4-898c-5250a6608d51")
 VALUE_CORE_IP_ADDRESS_UUID = sys_uuid.UUID("0225c5ed-07db-45fe-8154-2b8b9cae388a")
+VAR_IAM_DEFAULT_CLIENT_UUID = sys_uuid.UUID("d23fa962-18b8-444f-81a0-027ece98fbdb")
+VAR_IAM_DEFAULT_CLIENT_ID_UUID = sys_uuid.UUID("239e2a55-c3ad-4adc-85a8-3fa90b669556")
+VAR_IAM_DEFAULT_CLIENT_SECRET_UUID = sys_uuid.UUID(
+    "784c1f6d-f9e2-47e0-a3ba-16725854ac09"
+)
 NETWORK_UUID = "1d4f64db-817a-4862-a588-c9e950823cc1"
 DEFAULT_DATETIME_FORMAT = "%Y-%m-%d %H:%M:%S.%f"
 DEFAULT_SQL_LIMIT = 100
diff --git a/exordos_core/compute/agents/universal/drivers/pool.py b/exordos_core/compute/agents/universal/drivers/pool.py
@@ -15,6 +15,7 @@
 #    under the License.
 
 import logging
+import os
 import typing as tp
 import uuid as sys_uuid
 
@@ -32,6 +33,7 @@
 from exordos_core.compute.pool.drivers import exceptions as driver_exc
 
 LOG = logging.getLogger(__name__)
+DRY_RUN_ENV = "EXO_AGENTS_DRY_RUN"
 
 
 class RootVolumeNotFound(ua_driver_exc.AgentDriverException):
@@ -90,7 +92,14 @@ def load_driver(self) -> driver_base.AbstractPoolDriver:
         driver_kind = self.driver_spec["driver"]
 
         class_ = utils.load_from_entry_point(nc.EP_MACHINE_POOL_DRIVERS, driver_kind)
-        driver = class_(self)
+
+        # NOTE(akremenetsky): We should use command approach for dry_run in agents,
+        # but it hasn't implemented yet so use environment variable.
+        # https://github.com/exordos/gcl_sdk/issues/124
+        # Check for dry run mode based on environment variable
+        dry_run = str(os.getenv(DRY_RUN_ENV)).lower() in {"1", "true", "yes"}
+
+        driver = class_(self, dry_run=dry_run)
         self.__driver_map__[driver_key] = driver
         return driver
 
diff --git a/exordos_core/compute/pool/drivers/base.py b/exordos_core/compute/pool/drivers/base.py
diff --git a/exordos_core/compute/pool/drivers/libvirt.py b/exordos_core/compute/pool/drivers/libvirt.py
